Loading...
1/*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM sockets.
26 */
27
28#include <linux/export.h>
29#include <linux/debugfs.h>
30
31#include <net/bluetooth/bluetooth.h>
32#include <net/bluetooth/hci_core.h>
33#include <net/bluetooth/l2cap.h>
34#include <net/bluetooth/rfcomm.h>
35
36static const struct proto_ops rfcomm_sock_ops;
37
38static struct bt_sock_list rfcomm_sk_list = {
39 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
40};
41
42static void rfcomm_sock_close(struct sock *sk);
43static void rfcomm_sock_kill(struct sock *sk);
44
45/* ---- DLC callbacks ----
46 *
47 * called under rfcomm_dlc_lock()
48 */
49static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
50{
51 struct sock *sk = d->owner;
52 if (!sk)
53 return;
54
55 atomic_add(skb->len, &sk->sk_rmem_alloc);
56 skb_queue_tail(&sk->sk_receive_queue, skb);
57 sk->sk_data_ready(sk);
58
59 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
60 rfcomm_dlc_throttle(d);
61}
62
63static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
64{
65 struct sock *sk = d->owner, *parent;
66 unsigned long flags;
67
68 if (!sk)
69 return;
70
71 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
72
73 local_irq_save(flags);
74 bh_lock_sock(sk);
75
76 if (err)
77 sk->sk_err = err;
78
79 sk->sk_state = d->state;
80
81 parent = bt_sk(sk)->parent;
82 if (parent) {
83 if (d->state == BT_CLOSED) {
84 sock_set_flag(sk, SOCK_ZAPPED);
85 bt_accept_unlink(sk);
86 }
87 parent->sk_data_ready(parent);
88 } else {
89 if (d->state == BT_CONNECTED)
90 rfcomm_session_getaddr(d->session,
91 &rfcomm_pi(sk)->src, NULL);
92 sk->sk_state_change(sk);
93 }
94
95 bh_unlock_sock(sk);
96 local_irq_restore(flags);
97
98 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
99 /* We have to drop DLC lock here, otherwise
100 * rfcomm_sock_destruct() will dead lock. */
101 rfcomm_dlc_unlock(d);
102 rfcomm_sock_kill(sk);
103 rfcomm_dlc_lock(d);
104 }
105}
106
107/* ---- Socket functions ---- */
108static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
109{
110 struct sock *sk = NULL;
111
112 sk_for_each(sk, &rfcomm_sk_list.head) {
113 if (rfcomm_pi(sk)->channel != channel)
114 continue;
115
116 if (bacmp(&rfcomm_pi(sk)->src, src))
117 continue;
118
119 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
120 break;
121 }
122
123 return sk ? sk : NULL;
124}
125
126/* Find socket with channel and source bdaddr.
127 * Returns closest match.
128 */
129static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
130{
131 struct sock *sk = NULL, *sk1 = NULL;
132
133 read_lock(&rfcomm_sk_list.lock);
134
135 sk_for_each(sk, &rfcomm_sk_list.head) {
136 if (state && sk->sk_state != state)
137 continue;
138
139 if (rfcomm_pi(sk)->channel == channel) {
140 /* Exact match. */
141 if (!bacmp(&rfcomm_pi(sk)->src, src))
142 break;
143
144 /* Closest match */
145 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
146 sk1 = sk;
147 }
148 }
149
150 read_unlock(&rfcomm_sk_list.lock);
151
152 return sk ? sk : sk1;
153}
154
155static void rfcomm_sock_destruct(struct sock *sk)
156{
157 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
158
159 BT_DBG("sk %p dlc %p", sk, d);
160
161 skb_queue_purge(&sk->sk_receive_queue);
162 skb_queue_purge(&sk->sk_write_queue);
163
164 rfcomm_dlc_lock(d);
165 rfcomm_pi(sk)->dlc = NULL;
166
167 /* Detach DLC if it's owned by this socket */
168 if (d->owner == sk)
169 d->owner = NULL;
170 rfcomm_dlc_unlock(d);
171
172 rfcomm_dlc_put(d);
173}
174
175static void rfcomm_sock_cleanup_listen(struct sock *parent)
176{
177 struct sock *sk;
178
179 BT_DBG("parent %p", parent);
180
181 /* Close not yet accepted dlcs */
182 while ((sk = bt_accept_dequeue(parent, NULL))) {
183 rfcomm_sock_close(sk);
184 rfcomm_sock_kill(sk);
185 }
186
187 parent->sk_state = BT_CLOSED;
188 sock_set_flag(parent, SOCK_ZAPPED);
189}
190
191/* Kill socket (only if zapped and orphan)
192 * Must be called on unlocked socket.
193 */
194static void rfcomm_sock_kill(struct sock *sk)
195{
196 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
197 return;
198
199 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
200
201 /* Kill poor orphan */
202 bt_sock_unlink(&rfcomm_sk_list, sk);
203 sock_set_flag(sk, SOCK_DEAD);
204 sock_put(sk);
205}
206
207static void __rfcomm_sock_close(struct sock *sk)
208{
209 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
210
211 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
212
213 switch (sk->sk_state) {
214 case BT_LISTEN:
215 rfcomm_sock_cleanup_listen(sk);
216 break;
217
218 case BT_CONNECT:
219 case BT_CONNECT2:
220 case BT_CONFIG:
221 case BT_CONNECTED:
222 rfcomm_dlc_close(d, 0);
223
224 default:
225 sock_set_flag(sk, SOCK_ZAPPED);
226 break;
227 }
228}
229
230/* Close socket.
231 * Must be called on unlocked socket.
232 */
233static void rfcomm_sock_close(struct sock *sk)
234{
235 lock_sock(sk);
236 __rfcomm_sock_close(sk);
237 release_sock(sk);
238}
239
240static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
241{
242 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
243
244 BT_DBG("sk %p", sk);
245
246 if (parent) {
247 sk->sk_type = parent->sk_type;
248 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
249 &bt_sk(parent)->flags);
250
251 pi->sec_level = rfcomm_pi(parent)->sec_level;
252 pi->role_switch = rfcomm_pi(parent)->role_switch;
253
254 security_sk_clone(parent, sk);
255 } else {
256 pi->dlc->defer_setup = 0;
257
258 pi->sec_level = BT_SECURITY_LOW;
259 pi->role_switch = 0;
260 }
261
262 pi->dlc->sec_level = pi->sec_level;
263 pi->dlc->role_switch = pi->role_switch;
264}
265
266static struct proto rfcomm_proto = {
267 .name = "RFCOMM",
268 .owner = THIS_MODULE,
269 .obj_size = sizeof(struct rfcomm_pinfo)
270};
271
272static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern)
273{
274 struct rfcomm_dlc *d;
275 struct sock *sk;
276
277 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern);
278 if (!sk)
279 return NULL;
280
281 sock_init_data(sock, sk);
282 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
283
284 d = rfcomm_dlc_alloc(prio);
285 if (!d) {
286 sk_free(sk);
287 return NULL;
288 }
289
290 d->data_ready = rfcomm_sk_data_ready;
291 d->state_change = rfcomm_sk_state_change;
292
293 rfcomm_pi(sk)->dlc = d;
294 d->owner = sk;
295
296 sk->sk_destruct = rfcomm_sock_destruct;
297 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
298
299 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
300 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
301
302 sock_reset_flag(sk, SOCK_ZAPPED);
303
304 sk->sk_protocol = proto;
305 sk->sk_state = BT_OPEN;
306
307 bt_sock_link(&rfcomm_sk_list, sk);
308
309 BT_DBG("sk %p", sk);
310 return sk;
311}
312
313static int rfcomm_sock_create(struct net *net, struct socket *sock,
314 int protocol, int kern)
315{
316 struct sock *sk;
317
318 BT_DBG("sock %p", sock);
319
320 sock->state = SS_UNCONNECTED;
321
322 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
323 return -ESOCKTNOSUPPORT;
324
325 sock->ops = &rfcomm_sock_ops;
326
327 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
328 if (!sk)
329 return -ENOMEM;
330
331 rfcomm_sock_init(sk, NULL);
332 return 0;
333}
334
335static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
336{
337 struct sockaddr_rc sa;
338 struct sock *sk = sock->sk;
339 int len, err = 0;
340
341 if (!addr || addr->sa_family != AF_BLUETOOTH)
342 return -EINVAL;
343
344 memset(&sa, 0, sizeof(sa));
345 len = min_t(unsigned int, sizeof(sa), addr_len);
346 memcpy(&sa, addr, len);
347
348 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
349
350 lock_sock(sk);
351
352 if (sk->sk_state != BT_OPEN) {
353 err = -EBADFD;
354 goto done;
355 }
356
357 if (sk->sk_type != SOCK_STREAM) {
358 err = -EINVAL;
359 goto done;
360 }
361
362 write_lock(&rfcomm_sk_list.lock);
363
364 if (sa.rc_channel &&
365 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
366 err = -EADDRINUSE;
367 } else {
368 /* Save source address */
369 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
370 rfcomm_pi(sk)->channel = sa.rc_channel;
371 sk->sk_state = BT_BOUND;
372 }
373
374 write_unlock(&rfcomm_sk_list.lock);
375
376done:
377 release_sock(sk);
378 return err;
379}
380
381static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
382{
383 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
384 struct sock *sk = sock->sk;
385 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
386 int err = 0;
387
388 BT_DBG("sk %p", sk);
389
390 if (alen < sizeof(struct sockaddr_rc) ||
391 addr->sa_family != AF_BLUETOOTH)
392 return -EINVAL;
393
394 lock_sock(sk);
395
396 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
397 err = -EBADFD;
398 goto done;
399 }
400
401 if (sk->sk_type != SOCK_STREAM) {
402 err = -EINVAL;
403 goto done;
404 }
405
406 sk->sk_state = BT_CONNECT;
407 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
408 rfcomm_pi(sk)->channel = sa->rc_channel;
409
410 d->sec_level = rfcomm_pi(sk)->sec_level;
411 d->role_switch = rfcomm_pi(sk)->role_switch;
412
413 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
414 sa->rc_channel);
415 if (!err)
416 err = bt_sock_wait_state(sk, BT_CONNECTED,
417 sock_sndtimeo(sk, flags & O_NONBLOCK));
418
419done:
420 release_sock(sk);
421 return err;
422}
423
424static int rfcomm_sock_listen(struct socket *sock, int backlog)
425{
426 struct sock *sk = sock->sk;
427 int err = 0;
428
429 BT_DBG("sk %p backlog %d", sk, backlog);
430
431 lock_sock(sk);
432
433 if (sk->sk_state != BT_BOUND) {
434 err = -EBADFD;
435 goto done;
436 }
437
438 if (sk->sk_type != SOCK_STREAM) {
439 err = -EINVAL;
440 goto done;
441 }
442
443 if (!rfcomm_pi(sk)->channel) {
444 bdaddr_t *src = &rfcomm_pi(sk)->src;
445 u8 channel;
446
447 err = -EINVAL;
448
449 write_lock(&rfcomm_sk_list.lock);
450
451 for (channel = 1; channel < 31; channel++)
452 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
453 rfcomm_pi(sk)->channel = channel;
454 err = 0;
455 break;
456 }
457
458 write_unlock(&rfcomm_sk_list.lock);
459
460 if (err < 0)
461 goto done;
462 }
463
464 sk->sk_max_ack_backlog = backlog;
465 sk->sk_ack_backlog = 0;
466 sk->sk_state = BT_LISTEN;
467
468done:
469 release_sock(sk);
470 return err;
471}
472
473static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
474{
475 DEFINE_WAIT_FUNC(wait, woken_wake_function);
476 struct sock *sk = sock->sk, *nsk;
477 long timeo;
478 int err = 0;
479
480 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
481
482 if (sk->sk_type != SOCK_STREAM) {
483 err = -EINVAL;
484 goto done;
485 }
486
487 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
488
489 BT_DBG("sk %p timeo %ld", sk, timeo);
490
491 /* Wait for an incoming connection. (wake-one). */
492 add_wait_queue_exclusive(sk_sleep(sk), &wait);
493 while (1) {
494 if (sk->sk_state != BT_LISTEN) {
495 err = -EBADFD;
496 break;
497 }
498
499 nsk = bt_accept_dequeue(sk, newsock);
500 if (nsk)
501 break;
502
503 if (!timeo) {
504 err = -EAGAIN;
505 break;
506 }
507
508 if (signal_pending(current)) {
509 err = sock_intr_errno(timeo);
510 break;
511 }
512
513 release_sock(sk);
514
515 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
516
517 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
518 }
519 remove_wait_queue(sk_sleep(sk), &wait);
520
521 if (err)
522 goto done;
523
524 newsock->state = SS_CONNECTED;
525
526 BT_DBG("new socket %p", nsk);
527
528done:
529 release_sock(sk);
530 return err;
531}
532
533static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
534{
535 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
536 struct sock *sk = sock->sk;
537
538 BT_DBG("sock %p, sk %p", sock, sk);
539
540 if (peer && sk->sk_state != BT_CONNECTED &&
541 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
542 return -ENOTCONN;
543
544 memset(sa, 0, sizeof(*sa));
545 sa->rc_family = AF_BLUETOOTH;
546 sa->rc_channel = rfcomm_pi(sk)->channel;
547 if (peer)
548 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
549 else
550 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
551
552 *len = sizeof(struct sockaddr_rc);
553 return 0;
554}
555
556static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
557 size_t len)
558{
559 struct sock *sk = sock->sk;
560 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
561 struct sk_buff *skb;
562 int sent;
563
564 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
565 return -ENOTCONN;
566
567 if (msg->msg_flags & MSG_OOB)
568 return -EOPNOTSUPP;
569
570 if (sk->sk_shutdown & SEND_SHUTDOWN)
571 return -EPIPE;
572
573 BT_DBG("sock %p, sk %p", sock, sk);
574
575 lock_sock(sk);
576
577 sent = bt_sock_wait_ready(sk, msg->msg_flags);
578 if (sent)
579 goto done;
580
581 while (len) {
582 size_t size = min_t(size_t, len, d->mtu);
583 int err;
584
585 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
586 msg->msg_flags & MSG_DONTWAIT, &err);
587 if (!skb) {
588 if (sent == 0)
589 sent = err;
590 break;
591 }
592 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
593
594 err = memcpy_from_msg(skb_put(skb, size), msg, size);
595 if (err) {
596 kfree_skb(skb);
597 if (sent == 0)
598 sent = err;
599 break;
600 }
601
602 skb->priority = sk->sk_priority;
603
604 err = rfcomm_dlc_send(d, skb);
605 if (err < 0) {
606 kfree_skb(skb);
607 if (sent == 0)
608 sent = err;
609 break;
610 }
611
612 sent += size;
613 len -= size;
614 }
615
616done:
617 release_sock(sk);
618
619 return sent;
620}
621
622static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
623 size_t size, int flags)
624{
625 struct sock *sk = sock->sk;
626 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
627 int len;
628
629 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
630 rfcomm_dlc_accept(d);
631 return 0;
632 }
633
634 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
635
636 lock_sock(sk);
637 if (!(flags & MSG_PEEK) && len > 0)
638 atomic_sub(len, &sk->sk_rmem_alloc);
639
640 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
641 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
642 release_sock(sk);
643
644 return len;
645}
646
647static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
648{
649 struct sock *sk = sock->sk;
650 int err = 0;
651 u32 opt;
652
653 BT_DBG("sk %p", sk);
654
655 lock_sock(sk);
656
657 switch (optname) {
658 case RFCOMM_LM:
659 if (get_user(opt, (u32 __user *) optval)) {
660 err = -EFAULT;
661 break;
662 }
663
664 if (opt & RFCOMM_LM_FIPS) {
665 err = -EINVAL;
666 break;
667 }
668
669 if (opt & RFCOMM_LM_AUTH)
670 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
671 if (opt & RFCOMM_LM_ENCRYPT)
672 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
673 if (opt & RFCOMM_LM_SECURE)
674 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
675
676 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
677 break;
678
679 default:
680 err = -ENOPROTOOPT;
681 break;
682 }
683
684 release_sock(sk);
685 return err;
686}
687
688static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
689{
690 struct sock *sk = sock->sk;
691 struct bt_security sec;
692 int err = 0;
693 size_t len;
694 u32 opt;
695
696 BT_DBG("sk %p", sk);
697
698 if (level == SOL_RFCOMM)
699 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
700
701 if (level != SOL_BLUETOOTH)
702 return -ENOPROTOOPT;
703
704 lock_sock(sk);
705
706 switch (optname) {
707 case BT_SECURITY:
708 if (sk->sk_type != SOCK_STREAM) {
709 err = -EINVAL;
710 break;
711 }
712
713 sec.level = BT_SECURITY_LOW;
714
715 len = min_t(unsigned int, sizeof(sec), optlen);
716 if (copy_from_user((char *) &sec, optval, len)) {
717 err = -EFAULT;
718 break;
719 }
720
721 if (sec.level > BT_SECURITY_HIGH) {
722 err = -EINVAL;
723 break;
724 }
725
726 rfcomm_pi(sk)->sec_level = sec.level;
727 break;
728
729 case BT_DEFER_SETUP:
730 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
731 err = -EINVAL;
732 break;
733 }
734
735 if (get_user(opt, (u32 __user *) optval)) {
736 err = -EFAULT;
737 break;
738 }
739
740 if (opt)
741 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
742 else
743 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
744
745 break;
746
747 default:
748 err = -ENOPROTOOPT;
749 break;
750 }
751
752 release_sock(sk);
753 return err;
754}
755
756static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
757{
758 struct sock *sk = sock->sk;
759 struct sock *l2cap_sk;
760 struct l2cap_conn *conn;
761 struct rfcomm_conninfo cinfo;
762 int len, err = 0;
763 u32 opt;
764
765 BT_DBG("sk %p", sk);
766
767 if (get_user(len, optlen))
768 return -EFAULT;
769
770 lock_sock(sk);
771
772 switch (optname) {
773 case RFCOMM_LM:
774 switch (rfcomm_pi(sk)->sec_level) {
775 case BT_SECURITY_LOW:
776 opt = RFCOMM_LM_AUTH;
777 break;
778 case BT_SECURITY_MEDIUM:
779 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
780 break;
781 case BT_SECURITY_HIGH:
782 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
783 RFCOMM_LM_SECURE;
784 break;
785 case BT_SECURITY_FIPS:
786 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
787 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
788 break;
789 default:
790 opt = 0;
791 break;
792 }
793
794 if (rfcomm_pi(sk)->role_switch)
795 opt |= RFCOMM_LM_MASTER;
796
797 if (put_user(opt, (u32 __user *) optval))
798 err = -EFAULT;
799
800 break;
801
802 case RFCOMM_CONNINFO:
803 if (sk->sk_state != BT_CONNECTED &&
804 !rfcomm_pi(sk)->dlc->defer_setup) {
805 err = -ENOTCONN;
806 break;
807 }
808
809 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
810 conn = l2cap_pi(l2cap_sk)->chan->conn;
811
812 memset(&cinfo, 0, sizeof(cinfo));
813 cinfo.hci_handle = conn->hcon->handle;
814 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
815
816 len = min_t(unsigned int, len, sizeof(cinfo));
817 if (copy_to_user(optval, (char *) &cinfo, len))
818 err = -EFAULT;
819
820 break;
821
822 default:
823 err = -ENOPROTOOPT;
824 break;
825 }
826
827 release_sock(sk);
828 return err;
829}
830
831static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
832{
833 struct sock *sk = sock->sk;
834 struct bt_security sec;
835 int len, err = 0;
836
837 BT_DBG("sk %p", sk);
838
839 if (level == SOL_RFCOMM)
840 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
841
842 if (level != SOL_BLUETOOTH)
843 return -ENOPROTOOPT;
844
845 if (get_user(len, optlen))
846 return -EFAULT;
847
848 lock_sock(sk);
849
850 switch (optname) {
851 case BT_SECURITY:
852 if (sk->sk_type != SOCK_STREAM) {
853 err = -EINVAL;
854 break;
855 }
856
857 sec.level = rfcomm_pi(sk)->sec_level;
858 sec.key_size = 0;
859
860 len = min_t(unsigned int, len, sizeof(sec));
861 if (copy_to_user(optval, (char *) &sec, len))
862 err = -EFAULT;
863
864 break;
865
866 case BT_DEFER_SETUP:
867 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
868 err = -EINVAL;
869 break;
870 }
871
872 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
873 (u32 __user *) optval))
874 err = -EFAULT;
875
876 break;
877
878 default:
879 err = -ENOPROTOOPT;
880 break;
881 }
882
883 release_sock(sk);
884 return err;
885}
886
887static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
888{
889 struct sock *sk __maybe_unused = sock->sk;
890 int err;
891
892 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
893
894 err = bt_sock_ioctl(sock, cmd, arg);
895
896 if (err == -ENOIOCTLCMD) {
897#ifdef CONFIG_BT_RFCOMM_TTY
898 lock_sock(sk);
899 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
900 release_sock(sk);
901#else
902 err = -EOPNOTSUPP;
903#endif
904 }
905
906 return err;
907}
908
909static int rfcomm_sock_shutdown(struct socket *sock, int how)
910{
911 struct sock *sk = sock->sk;
912 int err = 0;
913
914 BT_DBG("sock %p, sk %p", sock, sk);
915
916 if (!sk)
917 return 0;
918
919 lock_sock(sk);
920 if (!sk->sk_shutdown) {
921 sk->sk_shutdown = SHUTDOWN_MASK;
922 __rfcomm_sock_close(sk);
923
924 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
925 !(current->flags & PF_EXITING))
926 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
927 }
928 release_sock(sk);
929 return err;
930}
931
932static int rfcomm_sock_release(struct socket *sock)
933{
934 struct sock *sk = sock->sk;
935 int err;
936
937 BT_DBG("sock %p, sk %p", sock, sk);
938
939 if (!sk)
940 return 0;
941
942 err = rfcomm_sock_shutdown(sock, 2);
943
944 sock_orphan(sk);
945 rfcomm_sock_kill(sk);
946 return err;
947}
948
949/* ---- RFCOMM core layer callbacks ----
950 *
951 * called under rfcomm_lock()
952 */
953int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
954{
955 struct sock *sk, *parent;
956 bdaddr_t src, dst;
957 int result = 0;
958
959 BT_DBG("session %p channel %d", s, channel);
960
961 rfcomm_session_getaddr(s, &src, &dst);
962
963 /* Check if we have socket listening on channel */
964 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
965 if (!parent)
966 return 0;
967
968 bh_lock_sock(parent);
969
970 /* Check for backlog size */
971 if (sk_acceptq_is_full(parent)) {
972 BT_DBG("backlog full %d", parent->sk_ack_backlog);
973 goto done;
974 }
975
976 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
977 if (!sk)
978 goto done;
979
980 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
981
982 rfcomm_sock_init(sk, parent);
983 bacpy(&rfcomm_pi(sk)->src, &src);
984 bacpy(&rfcomm_pi(sk)->dst, &dst);
985 rfcomm_pi(sk)->channel = channel;
986
987 sk->sk_state = BT_CONFIG;
988 bt_accept_enqueue(parent, sk);
989
990 /* Accept connection and return socket DLC */
991 *d = rfcomm_pi(sk)->dlc;
992 result = 1;
993
994done:
995 bh_unlock_sock(parent);
996
997 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
998 parent->sk_state_change(parent);
999
1000 return result;
1001}
1002
1003static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1004{
1005 struct sock *sk;
1006
1007 read_lock(&rfcomm_sk_list.lock);
1008
1009 sk_for_each(sk, &rfcomm_sk_list.head) {
1010 seq_printf(f, "%pMR %pMR %d %d\n",
1011 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1012 sk->sk_state, rfcomm_pi(sk)->channel);
1013 }
1014
1015 read_unlock(&rfcomm_sk_list.lock);
1016
1017 return 0;
1018}
1019
1020static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
1021{
1022 return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1023}
1024
1025static const struct file_operations rfcomm_sock_debugfs_fops = {
1026 .open = rfcomm_sock_debugfs_open,
1027 .read = seq_read,
1028 .llseek = seq_lseek,
1029 .release = single_release,
1030};
1031
1032static struct dentry *rfcomm_sock_debugfs;
1033
1034static const struct proto_ops rfcomm_sock_ops = {
1035 .family = PF_BLUETOOTH,
1036 .owner = THIS_MODULE,
1037 .release = rfcomm_sock_release,
1038 .bind = rfcomm_sock_bind,
1039 .connect = rfcomm_sock_connect,
1040 .listen = rfcomm_sock_listen,
1041 .accept = rfcomm_sock_accept,
1042 .getname = rfcomm_sock_getname,
1043 .sendmsg = rfcomm_sock_sendmsg,
1044 .recvmsg = rfcomm_sock_recvmsg,
1045 .shutdown = rfcomm_sock_shutdown,
1046 .setsockopt = rfcomm_sock_setsockopt,
1047 .getsockopt = rfcomm_sock_getsockopt,
1048 .ioctl = rfcomm_sock_ioctl,
1049 .poll = bt_sock_poll,
1050 .socketpair = sock_no_socketpair,
1051 .mmap = sock_no_mmap
1052};
1053
1054static const struct net_proto_family rfcomm_sock_family_ops = {
1055 .family = PF_BLUETOOTH,
1056 .owner = THIS_MODULE,
1057 .create = rfcomm_sock_create
1058};
1059
1060int __init rfcomm_init_sockets(void)
1061{
1062 int err;
1063
1064 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1065
1066 err = proto_register(&rfcomm_proto, 0);
1067 if (err < 0)
1068 return err;
1069
1070 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1071 if (err < 0) {
1072 BT_ERR("RFCOMM socket layer registration failed");
1073 goto error;
1074 }
1075
1076 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1077 if (err < 0) {
1078 BT_ERR("Failed to create RFCOMM proc file");
1079 bt_sock_unregister(BTPROTO_RFCOMM);
1080 goto error;
1081 }
1082
1083 BT_INFO("RFCOMM socket layer initialized");
1084
1085 if (IS_ERR_OR_NULL(bt_debugfs))
1086 return 0;
1087
1088 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1089 bt_debugfs, NULL,
1090 &rfcomm_sock_debugfs_fops);
1091
1092 return 0;
1093
1094error:
1095 proto_unregister(&rfcomm_proto);
1096 return err;
1097}
1098
1099void __exit rfcomm_cleanup_sockets(void)
1100{
1101 bt_procfs_cleanup(&init_net, "rfcomm");
1102
1103 debugfs_remove(rfcomm_sock_debugfs);
1104
1105 bt_sock_unregister(BTPROTO_RFCOMM);
1106
1107 proto_unregister(&rfcomm_proto);
1108}
1/*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM sockets.
26 */
27#include <linux/compat.h>
28#include <linux/export.h>
29#include <linux/debugfs.h>
30#include <linux/sched/signal.h>
31
32#include <net/bluetooth/bluetooth.h>
33#include <net/bluetooth/hci_core.h>
34#include <net/bluetooth/l2cap.h>
35#include <net/bluetooth/rfcomm.h>
36
37static const struct proto_ops rfcomm_sock_ops;
38
39static struct bt_sock_list rfcomm_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
41};
42
43static void rfcomm_sock_close(struct sock *sk);
44static void rfcomm_sock_kill(struct sock *sk);
45
46/* ---- DLC callbacks ----
47 *
48 * called under rfcomm_dlc_lock()
49 */
50static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
51{
52 struct sock *sk = d->owner;
53 if (!sk)
54 return;
55
56 atomic_add(skb->len, &sk->sk_rmem_alloc);
57 skb_queue_tail(&sk->sk_receive_queue, skb);
58 sk->sk_data_ready(sk);
59
60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
61 rfcomm_dlc_throttle(d);
62}
63
64static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
65{
66 struct sock *sk = d->owner, *parent;
67
68 if (!sk)
69 return;
70
71 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
72
73 lock_sock(sk);
74
75 if (err)
76 sk->sk_err = err;
77
78 sk->sk_state = d->state;
79
80 parent = bt_sk(sk)->parent;
81 if (parent) {
82 if (d->state == BT_CLOSED) {
83 sock_set_flag(sk, SOCK_ZAPPED);
84 bt_accept_unlink(sk);
85 }
86 parent->sk_data_ready(parent);
87 } else {
88 if (d->state == BT_CONNECTED)
89 rfcomm_session_getaddr(d->session,
90 &rfcomm_pi(sk)->src, NULL);
91 sk->sk_state_change(sk);
92 }
93
94 release_sock(sk);
95
96 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
97 /* We have to drop DLC lock here, otherwise
98 * rfcomm_sock_destruct() will dead lock. */
99 rfcomm_dlc_unlock(d);
100 rfcomm_sock_kill(sk);
101 rfcomm_dlc_lock(d);
102 }
103}
104
105/* ---- Socket functions ---- */
106static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
107{
108 struct sock *sk = NULL;
109
110 sk_for_each(sk, &rfcomm_sk_list.head) {
111 if (rfcomm_pi(sk)->channel != channel)
112 continue;
113
114 if (bacmp(&rfcomm_pi(sk)->src, src))
115 continue;
116
117 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
118 break;
119 }
120
121 return sk ? sk : NULL;
122}
123
124/* Find socket with channel and source bdaddr.
125 * Returns closest match.
126 */
127static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
128{
129 struct sock *sk = NULL, *sk1 = NULL;
130
131 read_lock(&rfcomm_sk_list.lock);
132
133 sk_for_each(sk, &rfcomm_sk_list.head) {
134 if (state && sk->sk_state != state)
135 continue;
136
137 if (rfcomm_pi(sk)->channel == channel) {
138 /* Exact match. */
139 if (!bacmp(&rfcomm_pi(sk)->src, src))
140 break;
141
142 /* Closest match */
143 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
144 sk1 = sk;
145 }
146 }
147
148 read_unlock(&rfcomm_sk_list.lock);
149
150 return sk ? sk : sk1;
151}
152
153static void rfcomm_sock_destruct(struct sock *sk)
154{
155 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
156
157 BT_DBG("sk %p dlc %p", sk, d);
158
159 skb_queue_purge(&sk->sk_receive_queue);
160 skb_queue_purge(&sk->sk_write_queue);
161
162 rfcomm_dlc_lock(d);
163 rfcomm_pi(sk)->dlc = NULL;
164
165 /* Detach DLC if it's owned by this socket */
166 if (d->owner == sk)
167 d->owner = NULL;
168 rfcomm_dlc_unlock(d);
169
170 rfcomm_dlc_put(d);
171}
172
173static void rfcomm_sock_cleanup_listen(struct sock *parent)
174{
175 struct sock *sk;
176
177 BT_DBG("parent %p", parent);
178
179 /* Close not yet accepted dlcs */
180 while ((sk = bt_accept_dequeue(parent, NULL))) {
181 rfcomm_sock_close(sk);
182 rfcomm_sock_kill(sk);
183 }
184
185 parent->sk_state = BT_CLOSED;
186 sock_set_flag(parent, SOCK_ZAPPED);
187}
188
189/* Kill socket (only if zapped and orphan)
190 * Must be called on unlocked socket.
191 */
192static void rfcomm_sock_kill(struct sock *sk)
193{
194 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
195 return;
196
197 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
198
199 /* Kill poor orphan */
200 bt_sock_unlink(&rfcomm_sk_list, sk);
201 sock_set_flag(sk, SOCK_DEAD);
202 sock_put(sk);
203}
204
205static void __rfcomm_sock_close(struct sock *sk)
206{
207 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
208
209 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
210
211 switch (sk->sk_state) {
212 case BT_LISTEN:
213 rfcomm_sock_cleanup_listen(sk);
214 break;
215
216 case BT_CONNECT:
217 case BT_CONNECT2:
218 case BT_CONFIG:
219 case BT_CONNECTED:
220 rfcomm_dlc_close(d, 0);
221 fallthrough;
222
223 default:
224 sock_set_flag(sk, SOCK_ZAPPED);
225 break;
226 }
227}
228
229/* Close socket.
230 * Must be called on unlocked socket.
231 */
232static void rfcomm_sock_close(struct sock *sk)
233{
234 lock_sock(sk);
235 __rfcomm_sock_close(sk);
236 release_sock(sk);
237}
238
239static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
240{
241 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
242
243 BT_DBG("sk %p", sk);
244
245 if (parent) {
246 sk->sk_type = parent->sk_type;
247 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
248 &bt_sk(parent)->flags);
249
250 pi->sec_level = rfcomm_pi(parent)->sec_level;
251 pi->role_switch = rfcomm_pi(parent)->role_switch;
252
253 security_sk_clone(parent, sk);
254 } else {
255 pi->dlc->defer_setup = 0;
256
257 pi->sec_level = BT_SECURITY_LOW;
258 pi->role_switch = 0;
259 }
260
261 pi->dlc->sec_level = pi->sec_level;
262 pi->dlc->role_switch = pi->role_switch;
263}
264
265static struct proto rfcomm_proto = {
266 .name = "RFCOMM",
267 .owner = THIS_MODULE,
268 .obj_size = sizeof(struct rfcomm_pinfo)
269};
270
271static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern)
272{
273 struct rfcomm_dlc *d;
274 struct sock *sk;
275
276 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern);
277 if (!sk)
278 return NULL;
279
280 sock_init_data(sock, sk);
281 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
282
283 d = rfcomm_dlc_alloc(prio);
284 if (!d) {
285 sk_free(sk);
286 return NULL;
287 }
288
289 d->data_ready = rfcomm_sk_data_ready;
290 d->state_change = rfcomm_sk_state_change;
291
292 rfcomm_pi(sk)->dlc = d;
293 d->owner = sk;
294
295 sk->sk_destruct = rfcomm_sock_destruct;
296 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
297
298 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
299 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
300
301 sock_reset_flag(sk, SOCK_ZAPPED);
302
303 sk->sk_protocol = proto;
304 sk->sk_state = BT_OPEN;
305
306 bt_sock_link(&rfcomm_sk_list, sk);
307
308 BT_DBG("sk %p", sk);
309 return sk;
310}
311
312static int rfcomm_sock_create(struct net *net, struct socket *sock,
313 int protocol, int kern)
314{
315 struct sock *sk;
316
317 BT_DBG("sock %p", sock);
318
319 sock->state = SS_UNCONNECTED;
320
321 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
322 return -ESOCKTNOSUPPORT;
323
324 sock->ops = &rfcomm_sock_ops;
325
326 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
327 if (!sk)
328 return -ENOMEM;
329
330 rfcomm_sock_init(sk, NULL);
331 return 0;
332}
333
334static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
335{
336 struct sockaddr_rc sa;
337 struct sock *sk = sock->sk;
338 int len, err = 0;
339
340 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
341 addr->sa_family != AF_BLUETOOTH)
342 return -EINVAL;
343
344 memset(&sa, 0, sizeof(sa));
345 len = min_t(unsigned int, sizeof(sa), addr_len);
346 memcpy(&sa, addr, len);
347
348 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
349
350 lock_sock(sk);
351
352 if (sk->sk_state != BT_OPEN) {
353 err = -EBADFD;
354 goto done;
355 }
356
357 if (sk->sk_type != SOCK_STREAM) {
358 err = -EINVAL;
359 goto done;
360 }
361
362 write_lock(&rfcomm_sk_list.lock);
363
364 if (sa.rc_channel &&
365 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
366 err = -EADDRINUSE;
367 } else {
368 /* Save source address */
369 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
370 rfcomm_pi(sk)->channel = sa.rc_channel;
371 sk->sk_state = BT_BOUND;
372 }
373
374 write_unlock(&rfcomm_sk_list.lock);
375
376done:
377 release_sock(sk);
378 return err;
379}
380
381static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
382{
383 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
384 struct sock *sk = sock->sk;
385 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
386 int err = 0;
387
388 BT_DBG("sk %p", sk);
389
390 if (alen < sizeof(struct sockaddr_rc) ||
391 addr->sa_family != AF_BLUETOOTH)
392 return -EINVAL;
393
394 sock_hold(sk);
395 lock_sock(sk);
396
397 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
398 err = -EBADFD;
399 goto done;
400 }
401
402 if (sk->sk_type != SOCK_STREAM) {
403 err = -EINVAL;
404 goto done;
405 }
406
407 sk->sk_state = BT_CONNECT;
408 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
409 rfcomm_pi(sk)->channel = sa->rc_channel;
410
411 d->sec_level = rfcomm_pi(sk)->sec_level;
412 d->role_switch = rfcomm_pi(sk)->role_switch;
413
414 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */
415 release_sock(sk);
416 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
417 sa->rc_channel);
418 lock_sock(sk);
419 if (!err && !sock_flag(sk, SOCK_ZAPPED))
420 err = bt_sock_wait_state(sk, BT_CONNECTED,
421 sock_sndtimeo(sk, flags & O_NONBLOCK));
422
423done:
424 release_sock(sk);
425 sock_put(sk);
426 return err;
427}
428
429static int rfcomm_sock_listen(struct socket *sock, int backlog)
430{
431 struct sock *sk = sock->sk;
432 int err = 0;
433
434 BT_DBG("sk %p backlog %d", sk, backlog);
435
436 lock_sock(sk);
437
438 if (sk->sk_state != BT_BOUND) {
439 err = -EBADFD;
440 goto done;
441 }
442
443 if (sk->sk_type != SOCK_STREAM) {
444 err = -EINVAL;
445 goto done;
446 }
447
448 if (!rfcomm_pi(sk)->channel) {
449 bdaddr_t *src = &rfcomm_pi(sk)->src;
450 u8 channel;
451
452 err = -EINVAL;
453
454 write_lock(&rfcomm_sk_list.lock);
455
456 for (channel = 1; channel < 31; channel++)
457 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
458 rfcomm_pi(sk)->channel = channel;
459 err = 0;
460 break;
461 }
462
463 write_unlock(&rfcomm_sk_list.lock);
464
465 if (err < 0)
466 goto done;
467 }
468
469 sk->sk_max_ack_backlog = backlog;
470 sk->sk_ack_backlog = 0;
471 sk->sk_state = BT_LISTEN;
472
473done:
474 release_sock(sk);
475 return err;
476}
477
478static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
479 bool kern)
480{
481 DEFINE_WAIT_FUNC(wait, woken_wake_function);
482 struct sock *sk = sock->sk, *nsk;
483 long timeo;
484 int err = 0;
485
486 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
487
488 if (sk->sk_type != SOCK_STREAM) {
489 err = -EINVAL;
490 goto done;
491 }
492
493 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
494
495 BT_DBG("sk %p timeo %ld", sk, timeo);
496
497 /* Wait for an incoming connection. (wake-one). */
498 add_wait_queue_exclusive(sk_sleep(sk), &wait);
499 while (1) {
500 if (sk->sk_state != BT_LISTEN) {
501 err = -EBADFD;
502 break;
503 }
504
505 nsk = bt_accept_dequeue(sk, newsock);
506 if (nsk)
507 break;
508
509 if (!timeo) {
510 err = -EAGAIN;
511 break;
512 }
513
514 if (signal_pending(current)) {
515 err = sock_intr_errno(timeo);
516 break;
517 }
518
519 release_sock(sk);
520
521 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
522
523 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
524 }
525 remove_wait_queue(sk_sleep(sk), &wait);
526
527 if (err)
528 goto done;
529
530 newsock->state = SS_CONNECTED;
531
532 BT_DBG("new socket %p", nsk);
533
534done:
535 release_sock(sk);
536 return err;
537}
538
539static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
540{
541 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
542 struct sock *sk = sock->sk;
543
544 BT_DBG("sock %p, sk %p", sock, sk);
545
546 if (peer && sk->sk_state != BT_CONNECTED &&
547 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
548 return -ENOTCONN;
549
550 memset(sa, 0, sizeof(*sa));
551 sa->rc_family = AF_BLUETOOTH;
552 sa->rc_channel = rfcomm_pi(sk)->channel;
553 if (peer)
554 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
555 else
556 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
557
558 return sizeof(struct sockaddr_rc);
559}
560
561static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
562 size_t len)
563{
564 struct sock *sk = sock->sk;
565 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
566 struct sk_buff *skb;
567 int sent;
568
569 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
570 return -ENOTCONN;
571
572 if (msg->msg_flags & MSG_OOB)
573 return -EOPNOTSUPP;
574
575 if (sk->sk_shutdown & SEND_SHUTDOWN)
576 return -EPIPE;
577
578 BT_DBG("sock %p, sk %p", sock, sk);
579
580 lock_sock(sk);
581
582 sent = bt_sock_wait_ready(sk, msg->msg_flags);
583
584 release_sock(sk);
585
586 if (sent)
587 return sent;
588
589 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
590 RFCOMM_SKB_TAIL_RESERVE);
591 if (IS_ERR(skb))
592 return PTR_ERR(skb);
593
594 sent = rfcomm_dlc_send(d, skb);
595 if (sent < 0)
596 kfree_skb(skb);
597
598 return sent;
599}
600
601static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
602 size_t size, int flags)
603{
604 struct sock *sk = sock->sk;
605 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
606 int len;
607
608 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
609 rfcomm_dlc_accept(d);
610 return 0;
611 }
612
613 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
614
615 lock_sock(sk);
616 if (!(flags & MSG_PEEK) && len > 0)
617 atomic_sub(len, &sk->sk_rmem_alloc);
618
619 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
620 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
621 release_sock(sk);
622
623 return len;
624}
625
626static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
627 sockptr_t optval, unsigned int optlen)
628{
629 struct sock *sk = sock->sk;
630 int err = 0;
631 u32 opt;
632
633 BT_DBG("sk %p", sk);
634
635 lock_sock(sk);
636
637 switch (optname) {
638 case RFCOMM_LM:
639 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
640 err = -EFAULT;
641 break;
642 }
643
644 if (opt & RFCOMM_LM_FIPS) {
645 err = -EINVAL;
646 break;
647 }
648
649 if (opt & RFCOMM_LM_AUTH)
650 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
651 if (opt & RFCOMM_LM_ENCRYPT)
652 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
653 if (opt & RFCOMM_LM_SECURE)
654 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
655
656 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
657 break;
658
659 default:
660 err = -ENOPROTOOPT;
661 break;
662 }
663
664 release_sock(sk);
665 return err;
666}
667
668static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
669 sockptr_t optval, unsigned int optlen)
670{
671 struct sock *sk = sock->sk;
672 struct bt_security sec;
673 int err = 0;
674 size_t len;
675 u32 opt;
676
677 BT_DBG("sk %p", sk);
678
679 if (level == SOL_RFCOMM)
680 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
681
682 if (level != SOL_BLUETOOTH)
683 return -ENOPROTOOPT;
684
685 lock_sock(sk);
686
687 switch (optname) {
688 case BT_SECURITY:
689 if (sk->sk_type != SOCK_STREAM) {
690 err = -EINVAL;
691 break;
692 }
693
694 sec.level = BT_SECURITY_LOW;
695
696 len = min_t(unsigned int, sizeof(sec), optlen);
697 if (copy_from_sockptr(&sec, optval, len)) {
698 err = -EFAULT;
699 break;
700 }
701
702 if (sec.level > BT_SECURITY_HIGH) {
703 err = -EINVAL;
704 break;
705 }
706
707 rfcomm_pi(sk)->sec_level = sec.level;
708 break;
709
710 case BT_DEFER_SETUP:
711 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
712 err = -EINVAL;
713 break;
714 }
715
716 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
717 err = -EFAULT;
718 break;
719 }
720
721 if (opt)
722 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
723 else
724 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
725
726 break;
727
728 default:
729 err = -ENOPROTOOPT;
730 break;
731 }
732
733 release_sock(sk);
734 return err;
735}
736
737static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
738{
739 struct sock *sk = sock->sk;
740 struct sock *l2cap_sk;
741 struct l2cap_conn *conn;
742 struct rfcomm_conninfo cinfo;
743 int len, err = 0;
744 u32 opt;
745
746 BT_DBG("sk %p", sk);
747
748 if (get_user(len, optlen))
749 return -EFAULT;
750
751 lock_sock(sk);
752
753 switch (optname) {
754 case RFCOMM_LM:
755 switch (rfcomm_pi(sk)->sec_level) {
756 case BT_SECURITY_LOW:
757 opt = RFCOMM_LM_AUTH;
758 break;
759 case BT_SECURITY_MEDIUM:
760 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
761 break;
762 case BT_SECURITY_HIGH:
763 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
764 RFCOMM_LM_SECURE;
765 break;
766 case BT_SECURITY_FIPS:
767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
768 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
769 break;
770 default:
771 opt = 0;
772 break;
773 }
774
775 if (rfcomm_pi(sk)->role_switch)
776 opt |= RFCOMM_LM_MASTER;
777
778 if (put_user(opt, (u32 __user *) optval))
779 err = -EFAULT;
780
781 break;
782
783 case RFCOMM_CONNINFO:
784 if (sk->sk_state != BT_CONNECTED &&
785 !rfcomm_pi(sk)->dlc->defer_setup) {
786 err = -ENOTCONN;
787 break;
788 }
789
790 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
791 conn = l2cap_pi(l2cap_sk)->chan->conn;
792
793 memset(&cinfo, 0, sizeof(cinfo));
794 cinfo.hci_handle = conn->hcon->handle;
795 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
796
797 len = min_t(unsigned int, len, sizeof(cinfo));
798 if (copy_to_user(optval, (char *) &cinfo, len))
799 err = -EFAULT;
800
801 break;
802
803 default:
804 err = -ENOPROTOOPT;
805 break;
806 }
807
808 release_sock(sk);
809 return err;
810}
811
812static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
813{
814 struct sock *sk = sock->sk;
815 struct bt_security sec;
816 int len, err = 0;
817
818 BT_DBG("sk %p", sk);
819
820 if (level == SOL_RFCOMM)
821 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
822
823 if (level != SOL_BLUETOOTH)
824 return -ENOPROTOOPT;
825
826 if (get_user(len, optlen))
827 return -EFAULT;
828
829 lock_sock(sk);
830
831 switch (optname) {
832 case BT_SECURITY:
833 if (sk->sk_type != SOCK_STREAM) {
834 err = -EINVAL;
835 break;
836 }
837
838 sec.level = rfcomm_pi(sk)->sec_level;
839 sec.key_size = 0;
840
841 len = min_t(unsigned int, len, sizeof(sec));
842 if (copy_to_user(optval, (char *) &sec, len))
843 err = -EFAULT;
844
845 break;
846
847 case BT_DEFER_SETUP:
848 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
849 err = -EINVAL;
850 break;
851 }
852
853 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
854 (u32 __user *) optval))
855 err = -EFAULT;
856
857 break;
858
859 default:
860 err = -ENOPROTOOPT;
861 break;
862 }
863
864 release_sock(sk);
865 return err;
866}
867
868static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
869{
870 struct sock *sk __maybe_unused = sock->sk;
871 int err;
872
873 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
874
875 err = bt_sock_ioctl(sock, cmd, arg);
876
877 if (err == -ENOIOCTLCMD) {
878#ifdef CONFIG_BT_RFCOMM_TTY
879 lock_sock(sk);
880 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
881 release_sock(sk);
882#else
883 err = -EOPNOTSUPP;
884#endif
885 }
886
887 return err;
888}
889
890#ifdef CONFIG_COMPAT
891static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
892{
893 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
894}
895#endif
896
897static int rfcomm_sock_shutdown(struct socket *sock, int how)
898{
899 struct sock *sk = sock->sk;
900 int err = 0;
901
902 BT_DBG("sock %p, sk %p", sock, sk);
903
904 if (!sk)
905 return 0;
906
907 lock_sock(sk);
908 if (!sk->sk_shutdown) {
909 sk->sk_shutdown = SHUTDOWN_MASK;
910
911 release_sock(sk);
912 __rfcomm_sock_close(sk);
913 lock_sock(sk);
914
915 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
916 !(current->flags & PF_EXITING))
917 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
918 }
919 release_sock(sk);
920 return err;
921}
922
923static int rfcomm_sock_release(struct socket *sock)
924{
925 struct sock *sk = sock->sk;
926 int err;
927
928 BT_DBG("sock %p, sk %p", sock, sk);
929
930 if (!sk)
931 return 0;
932
933 err = rfcomm_sock_shutdown(sock, 2);
934
935 sock_orphan(sk);
936 rfcomm_sock_kill(sk);
937 return err;
938}
939
940/* ---- RFCOMM core layer callbacks ----
941 *
942 * called under rfcomm_lock()
943 */
944int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
945{
946 struct sock *sk, *parent;
947 bdaddr_t src, dst;
948 int result = 0;
949
950 BT_DBG("session %p channel %d", s, channel);
951
952 rfcomm_session_getaddr(s, &src, &dst);
953
954 /* Check if we have socket listening on channel */
955 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
956 if (!parent)
957 return 0;
958
959 lock_sock(parent);
960
961 /* Check for backlog size */
962 if (sk_acceptq_is_full(parent)) {
963 BT_DBG("backlog full %d", parent->sk_ack_backlog);
964 goto done;
965 }
966
967 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
968 if (!sk)
969 goto done;
970
971 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
972
973 rfcomm_sock_init(sk, parent);
974 bacpy(&rfcomm_pi(sk)->src, &src);
975 bacpy(&rfcomm_pi(sk)->dst, &dst);
976 rfcomm_pi(sk)->channel = channel;
977
978 sk->sk_state = BT_CONFIG;
979 bt_accept_enqueue(parent, sk, true);
980
981 /* Accept connection and return socket DLC */
982 *d = rfcomm_pi(sk)->dlc;
983 result = 1;
984
985done:
986 release_sock(parent);
987
988 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
989 parent->sk_state_change(parent);
990
991 return result;
992}
993
994static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
995{
996 struct sock *sk;
997
998 read_lock(&rfcomm_sk_list.lock);
999
1000 sk_for_each(sk, &rfcomm_sk_list.head) {
1001 seq_printf(f, "%pMR %pMR %d %d\n",
1002 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1003 sk->sk_state, rfcomm_pi(sk)->channel);
1004 }
1005
1006 read_unlock(&rfcomm_sk_list.lock);
1007
1008 return 0;
1009}
1010
1011DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1012
1013static struct dentry *rfcomm_sock_debugfs;
1014
1015static const struct proto_ops rfcomm_sock_ops = {
1016 .family = PF_BLUETOOTH,
1017 .owner = THIS_MODULE,
1018 .release = rfcomm_sock_release,
1019 .bind = rfcomm_sock_bind,
1020 .connect = rfcomm_sock_connect,
1021 .listen = rfcomm_sock_listen,
1022 .accept = rfcomm_sock_accept,
1023 .getname = rfcomm_sock_getname,
1024 .sendmsg = rfcomm_sock_sendmsg,
1025 .recvmsg = rfcomm_sock_recvmsg,
1026 .shutdown = rfcomm_sock_shutdown,
1027 .setsockopt = rfcomm_sock_setsockopt,
1028 .getsockopt = rfcomm_sock_getsockopt,
1029 .ioctl = rfcomm_sock_ioctl,
1030 .gettstamp = sock_gettstamp,
1031 .poll = bt_sock_poll,
1032 .socketpair = sock_no_socketpair,
1033 .mmap = sock_no_mmap,
1034#ifdef CONFIG_COMPAT
1035 .compat_ioctl = rfcomm_sock_compat_ioctl,
1036#endif
1037};
1038
1039static const struct net_proto_family rfcomm_sock_family_ops = {
1040 .family = PF_BLUETOOTH,
1041 .owner = THIS_MODULE,
1042 .create = rfcomm_sock_create
1043};
1044
1045int __init rfcomm_init_sockets(void)
1046{
1047 int err;
1048
1049 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1050
1051 err = proto_register(&rfcomm_proto, 0);
1052 if (err < 0)
1053 return err;
1054
1055 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1056 if (err < 0) {
1057 BT_ERR("RFCOMM socket layer registration failed");
1058 goto error;
1059 }
1060
1061 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1062 if (err < 0) {
1063 BT_ERR("Failed to create RFCOMM proc file");
1064 bt_sock_unregister(BTPROTO_RFCOMM);
1065 goto error;
1066 }
1067
1068 BT_INFO("RFCOMM socket layer initialized");
1069
1070 if (IS_ERR_OR_NULL(bt_debugfs))
1071 return 0;
1072
1073 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1074 bt_debugfs, NULL,
1075 &rfcomm_sock_debugfs_fops);
1076
1077 return 0;
1078
1079error:
1080 proto_unregister(&rfcomm_proto);
1081 return err;
1082}
1083
1084void __exit rfcomm_cleanup_sockets(void)
1085{
1086 bt_procfs_cleanup(&init_net, "rfcomm");
1087
1088 debugfs_remove(rfcomm_sock_debugfs);
1089
1090 bt_sock_unregister(BTPROTO_RFCOMM);
1091
1092 proto_unregister(&rfcomm_proto);
1093}