Loading...
1/*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM sockets.
26 */
27
28#include <linux/export.h>
29#include <linux/debugfs.h>
30#include <linux/sched/signal.h>
31
32#include <net/bluetooth/bluetooth.h>
33#include <net/bluetooth/hci_core.h>
34#include <net/bluetooth/l2cap.h>
35#include <net/bluetooth/rfcomm.h>
36
37static const struct proto_ops rfcomm_sock_ops;
38
39static struct bt_sock_list rfcomm_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
41};
42
43static void rfcomm_sock_close(struct sock *sk);
44static void rfcomm_sock_kill(struct sock *sk);
45
46/* ---- DLC callbacks ----
47 *
48 * called under rfcomm_dlc_lock()
49 */
50static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
51{
52 struct sock *sk = d->owner;
53 if (!sk)
54 return;
55
56 atomic_add(skb->len, &sk->sk_rmem_alloc);
57 skb_queue_tail(&sk->sk_receive_queue, skb);
58 sk->sk_data_ready(sk);
59
60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
61 rfcomm_dlc_throttle(d);
62}
63
64static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
65{
66 struct sock *sk = d->owner, *parent;
67 unsigned long flags;
68
69 if (!sk)
70 return;
71
72 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
73
74 local_irq_save(flags);
75 bh_lock_sock(sk);
76
77 if (err)
78 sk->sk_err = err;
79
80 sk->sk_state = d->state;
81
82 parent = bt_sk(sk)->parent;
83 if (parent) {
84 if (d->state == BT_CLOSED) {
85 sock_set_flag(sk, SOCK_ZAPPED);
86 bt_accept_unlink(sk);
87 }
88 parent->sk_data_ready(parent);
89 } else {
90 if (d->state == BT_CONNECTED)
91 rfcomm_session_getaddr(d->session,
92 &rfcomm_pi(sk)->src, NULL);
93 sk->sk_state_change(sk);
94 }
95
96 bh_unlock_sock(sk);
97 local_irq_restore(flags);
98
99 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
100 /* We have to drop DLC lock here, otherwise
101 * rfcomm_sock_destruct() will dead lock. */
102 rfcomm_dlc_unlock(d);
103 rfcomm_sock_kill(sk);
104 rfcomm_dlc_lock(d);
105 }
106}
107
108/* ---- Socket functions ---- */
109static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
110{
111 struct sock *sk = NULL;
112
113 sk_for_each(sk, &rfcomm_sk_list.head) {
114 if (rfcomm_pi(sk)->channel != channel)
115 continue;
116
117 if (bacmp(&rfcomm_pi(sk)->src, src))
118 continue;
119
120 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
121 break;
122 }
123
124 return sk ? sk : NULL;
125}
126
127/* Find socket with channel and source bdaddr.
128 * Returns closest match.
129 */
130static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
131{
132 struct sock *sk = NULL, *sk1 = NULL;
133
134 read_lock(&rfcomm_sk_list.lock);
135
136 sk_for_each(sk, &rfcomm_sk_list.head) {
137 if (state && sk->sk_state != state)
138 continue;
139
140 if (rfcomm_pi(sk)->channel == channel) {
141 /* Exact match. */
142 if (!bacmp(&rfcomm_pi(sk)->src, src))
143 break;
144
145 /* Closest match */
146 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
147 sk1 = sk;
148 }
149 }
150
151 read_unlock(&rfcomm_sk_list.lock);
152
153 return sk ? sk : sk1;
154}
155
156static void rfcomm_sock_destruct(struct sock *sk)
157{
158 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
159
160 BT_DBG("sk %p dlc %p", sk, d);
161
162 skb_queue_purge(&sk->sk_receive_queue);
163 skb_queue_purge(&sk->sk_write_queue);
164
165 rfcomm_dlc_lock(d);
166 rfcomm_pi(sk)->dlc = NULL;
167
168 /* Detach DLC if it's owned by this socket */
169 if (d->owner == sk)
170 d->owner = NULL;
171 rfcomm_dlc_unlock(d);
172
173 rfcomm_dlc_put(d);
174}
175
176static void rfcomm_sock_cleanup_listen(struct sock *parent)
177{
178 struct sock *sk;
179
180 BT_DBG("parent %p", parent);
181
182 /* Close not yet accepted dlcs */
183 while ((sk = bt_accept_dequeue(parent, NULL))) {
184 rfcomm_sock_close(sk);
185 rfcomm_sock_kill(sk);
186 }
187
188 parent->sk_state = BT_CLOSED;
189 sock_set_flag(parent, SOCK_ZAPPED);
190}
191
192/* Kill socket (only if zapped and orphan)
193 * Must be called on unlocked socket.
194 */
195static void rfcomm_sock_kill(struct sock *sk)
196{
197 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
198 return;
199
200 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
201
202 /* Kill poor orphan */
203 bt_sock_unlink(&rfcomm_sk_list, sk);
204 sock_set_flag(sk, SOCK_DEAD);
205 sock_put(sk);
206}
207
208static void __rfcomm_sock_close(struct sock *sk)
209{
210 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
211
212 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
213
214 switch (sk->sk_state) {
215 case BT_LISTEN:
216 rfcomm_sock_cleanup_listen(sk);
217 break;
218
219 case BT_CONNECT:
220 case BT_CONNECT2:
221 case BT_CONFIG:
222 case BT_CONNECTED:
223 rfcomm_dlc_close(d, 0);
224 /* fall through */
225
226 default:
227 sock_set_flag(sk, SOCK_ZAPPED);
228 break;
229 }
230}
231
232/* Close socket.
233 * Must be called on unlocked socket.
234 */
235static void rfcomm_sock_close(struct sock *sk)
236{
237 lock_sock(sk);
238 __rfcomm_sock_close(sk);
239 release_sock(sk);
240}
241
242static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
243{
244 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
245
246 BT_DBG("sk %p", sk);
247
248 if (parent) {
249 sk->sk_type = parent->sk_type;
250 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
251 &bt_sk(parent)->flags);
252
253 pi->sec_level = rfcomm_pi(parent)->sec_level;
254 pi->role_switch = rfcomm_pi(parent)->role_switch;
255
256 security_sk_clone(parent, sk);
257 } else {
258 pi->dlc->defer_setup = 0;
259
260 pi->sec_level = BT_SECURITY_LOW;
261 pi->role_switch = 0;
262 }
263
264 pi->dlc->sec_level = pi->sec_level;
265 pi->dlc->role_switch = pi->role_switch;
266}
267
268static struct proto rfcomm_proto = {
269 .name = "RFCOMM",
270 .owner = THIS_MODULE,
271 .obj_size = sizeof(struct rfcomm_pinfo)
272};
273
274static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern)
275{
276 struct rfcomm_dlc *d;
277 struct sock *sk;
278
279 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern);
280 if (!sk)
281 return NULL;
282
283 sock_init_data(sock, sk);
284 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
285
286 d = rfcomm_dlc_alloc(prio);
287 if (!d) {
288 sk_free(sk);
289 return NULL;
290 }
291
292 d->data_ready = rfcomm_sk_data_ready;
293 d->state_change = rfcomm_sk_state_change;
294
295 rfcomm_pi(sk)->dlc = d;
296 d->owner = sk;
297
298 sk->sk_destruct = rfcomm_sock_destruct;
299 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
300
301 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
302 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
303
304 sock_reset_flag(sk, SOCK_ZAPPED);
305
306 sk->sk_protocol = proto;
307 sk->sk_state = BT_OPEN;
308
309 bt_sock_link(&rfcomm_sk_list, sk);
310
311 BT_DBG("sk %p", sk);
312 return sk;
313}
314
315static int rfcomm_sock_create(struct net *net, struct socket *sock,
316 int protocol, int kern)
317{
318 struct sock *sk;
319
320 BT_DBG("sock %p", sock);
321
322 sock->state = SS_UNCONNECTED;
323
324 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
325 return -ESOCKTNOSUPPORT;
326
327 sock->ops = &rfcomm_sock_ops;
328
329 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
330 if (!sk)
331 return -ENOMEM;
332
333 rfcomm_sock_init(sk, NULL);
334 return 0;
335}
336
337static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
338{
339 struct sockaddr_rc sa;
340 struct sock *sk = sock->sk;
341 int len, err = 0;
342
343 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
344 addr->sa_family != AF_BLUETOOTH)
345 return -EINVAL;
346
347 memset(&sa, 0, sizeof(sa));
348 len = min_t(unsigned int, sizeof(sa), addr_len);
349 memcpy(&sa, addr, len);
350
351 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
352
353 lock_sock(sk);
354
355 if (sk->sk_state != BT_OPEN) {
356 err = -EBADFD;
357 goto done;
358 }
359
360 if (sk->sk_type != SOCK_STREAM) {
361 err = -EINVAL;
362 goto done;
363 }
364
365 write_lock(&rfcomm_sk_list.lock);
366
367 if (sa.rc_channel &&
368 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
369 err = -EADDRINUSE;
370 } else {
371 /* Save source address */
372 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
373 rfcomm_pi(sk)->channel = sa.rc_channel;
374 sk->sk_state = BT_BOUND;
375 }
376
377 write_unlock(&rfcomm_sk_list.lock);
378
379done:
380 release_sock(sk);
381 return err;
382}
383
384static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
385{
386 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
387 struct sock *sk = sock->sk;
388 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
389 int err = 0;
390
391 BT_DBG("sk %p", sk);
392
393 if (alen < sizeof(struct sockaddr_rc) ||
394 addr->sa_family != AF_BLUETOOTH)
395 return -EINVAL;
396
397 lock_sock(sk);
398
399 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
400 err = -EBADFD;
401 goto done;
402 }
403
404 if (sk->sk_type != SOCK_STREAM) {
405 err = -EINVAL;
406 goto done;
407 }
408
409 sk->sk_state = BT_CONNECT;
410 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
411 rfcomm_pi(sk)->channel = sa->rc_channel;
412
413 d->sec_level = rfcomm_pi(sk)->sec_level;
414 d->role_switch = rfcomm_pi(sk)->role_switch;
415
416 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
417 sa->rc_channel);
418 if (!err)
419 err = bt_sock_wait_state(sk, BT_CONNECTED,
420 sock_sndtimeo(sk, flags & O_NONBLOCK));
421
422done:
423 release_sock(sk);
424 return err;
425}
426
427static int rfcomm_sock_listen(struct socket *sock, int backlog)
428{
429 struct sock *sk = sock->sk;
430 int err = 0;
431
432 BT_DBG("sk %p backlog %d", sk, backlog);
433
434 lock_sock(sk);
435
436 if (sk->sk_state != BT_BOUND) {
437 err = -EBADFD;
438 goto done;
439 }
440
441 if (sk->sk_type != SOCK_STREAM) {
442 err = -EINVAL;
443 goto done;
444 }
445
446 if (!rfcomm_pi(sk)->channel) {
447 bdaddr_t *src = &rfcomm_pi(sk)->src;
448 u8 channel;
449
450 err = -EINVAL;
451
452 write_lock(&rfcomm_sk_list.lock);
453
454 for (channel = 1; channel < 31; channel++)
455 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
456 rfcomm_pi(sk)->channel = channel;
457 err = 0;
458 break;
459 }
460
461 write_unlock(&rfcomm_sk_list.lock);
462
463 if (err < 0)
464 goto done;
465 }
466
467 sk->sk_max_ack_backlog = backlog;
468 sk->sk_ack_backlog = 0;
469 sk->sk_state = BT_LISTEN;
470
471done:
472 release_sock(sk);
473 return err;
474}
475
476static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
477 bool kern)
478{
479 DEFINE_WAIT_FUNC(wait, woken_wake_function);
480 struct sock *sk = sock->sk, *nsk;
481 long timeo;
482 int err = 0;
483
484 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
485
486 if (sk->sk_type != SOCK_STREAM) {
487 err = -EINVAL;
488 goto done;
489 }
490
491 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
492
493 BT_DBG("sk %p timeo %ld", sk, timeo);
494
495 /* Wait for an incoming connection. (wake-one). */
496 add_wait_queue_exclusive(sk_sleep(sk), &wait);
497 while (1) {
498 if (sk->sk_state != BT_LISTEN) {
499 err = -EBADFD;
500 break;
501 }
502
503 nsk = bt_accept_dequeue(sk, newsock);
504 if (nsk)
505 break;
506
507 if (!timeo) {
508 err = -EAGAIN;
509 break;
510 }
511
512 if (signal_pending(current)) {
513 err = sock_intr_errno(timeo);
514 break;
515 }
516
517 release_sock(sk);
518
519 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
520
521 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
522 }
523 remove_wait_queue(sk_sleep(sk), &wait);
524
525 if (err)
526 goto done;
527
528 newsock->state = SS_CONNECTED;
529
530 BT_DBG("new socket %p", nsk);
531
532done:
533 release_sock(sk);
534 return err;
535}
536
537static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
538{
539 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
540 struct sock *sk = sock->sk;
541
542 BT_DBG("sock %p, sk %p", sock, sk);
543
544 if (peer && sk->sk_state != BT_CONNECTED &&
545 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
546 return -ENOTCONN;
547
548 memset(sa, 0, sizeof(*sa));
549 sa->rc_family = AF_BLUETOOTH;
550 sa->rc_channel = rfcomm_pi(sk)->channel;
551 if (peer)
552 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
553 else
554 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
555
556 return sizeof(struct sockaddr_rc);
557}
558
559static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
560 size_t len)
561{
562 struct sock *sk = sock->sk;
563 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
564 struct sk_buff *skb;
565 int sent;
566
567 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
568 return -ENOTCONN;
569
570 if (msg->msg_flags & MSG_OOB)
571 return -EOPNOTSUPP;
572
573 if (sk->sk_shutdown & SEND_SHUTDOWN)
574 return -EPIPE;
575
576 BT_DBG("sock %p, sk %p", sock, sk);
577
578 lock_sock(sk);
579
580 sent = bt_sock_wait_ready(sk, msg->msg_flags);
581 if (sent)
582 goto done;
583
584 while (len) {
585 size_t size = min_t(size_t, len, d->mtu);
586 int err;
587
588 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
589 msg->msg_flags & MSG_DONTWAIT, &err);
590 if (!skb) {
591 if (sent == 0)
592 sent = err;
593 break;
594 }
595 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
596
597 err = memcpy_from_msg(skb_put(skb, size), msg, size);
598 if (err) {
599 kfree_skb(skb);
600 if (sent == 0)
601 sent = err;
602 break;
603 }
604
605 skb->priority = sk->sk_priority;
606
607 err = rfcomm_dlc_send(d, skb);
608 if (err < 0) {
609 kfree_skb(skb);
610 if (sent == 0)
611 sent = err;
612 break;
613 }
614
615 sent += size;
616 len -= size;
617 }
618
619done:
620 release_sock(sk);
621
622 return sent;
623}
624
625static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
626 size_t size, int flags)
627{
628 struct sock *sk = sock->sk;
629 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
630 int len;
631
632 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
633 rfcomm_dlc_accept(d);
634 return 0;
635 }
636
637 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
638
639 lock_sock(sk);
640 if (!(flags & MSG_PEEK) && len > 0)
641 atomic_sub(len, &sk->sk_rmem_alloc);
642
643 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
644 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
645 release_sock(sk);
646
647 return len;
648}
649
650static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
651{
652 struct sock *sk = sock->sk;
653 int err = 0;
654 u32 opt;
655
656 BT_DBG("sk %p", sk);
657
658 lock_sock(sk);
659
660 switch (optname) {
661 case RFCOMM_LM:
662 if (get_user(opt, (u32 __user *) optval)) {
663 err = -EFAULT;
664 break;
665 }
666
667 if (opt & RFCOMM_LM_FIPS) {
668 err = -EINVAL;
669 break;
670 }
671
672 if (opt & RFCOMM_LM_AUTH)
673 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
674 if (opt & RFCOMM_LM_ENCRYPT)
675 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
676 if (opt & RFCOMM_LM_SECURE)
677 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
678
679 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
680 break;
681
682 default:
683 err = -ENOPROTOOPT;
684 break;
685 }
686
687 release_sock(sk);
688 return err;
689}
690
691static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
692{
693 struct sock *sk = sock->sk;
694 struct bt_security sec;
695 int err = 0;
696 size_t len;
697 u32 opt;
698
699 BT_DBG("sk %p", sk);
700
701 if (level == SOL_RFCOMM)
702 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
703
704 if (level != SOL_BLUETOOTH)
705 return -ENOPROTOOPT;
706
707 lock_sock(sk);
708
709 switch (optname) {
710 case BT_SECURITY:
711 if (sk->sk_type != SOCK_STREAM) {
712 err = -EINVAL;
713 break;
714 }
715
716 sec.level = BT_SECURITY_LOW;
717
718 len = min_t(unsigned int, sizeof(sec), optlen);
719 if (copy_from_user((char *) &sec, optval, len)) {
720 err = -EFAULT;
721 break;
722 }
723
724 if (sec.level > BT_SECURITY_HIGH) {
725 err = -EINVAL;
726 break;
727 }
728
729 rfcomm_pi(sk)->sec_level = sec.level;
730 break;
731
732 case BT_DEFER_SETUP:
733 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
734 err = -EINVAL;
735 break;
736 }
737
738 if (get_user(opt, (u32 __user *) optval)) {
739 err = -EFAULT;
740 break;
741 }
742
743 if (opt)
744 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
745 else
746 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
747
748 break;
749
750 default:
751 err = -ENOPROTOOPT;
752 break;
753 }
754
755 release_sock(sk);
756 return err;
757}
758
759static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
760{
761 struct sock *sk = sock->sk;
762 struct sock *l2cap_sk;
763 struct l2cap_conn *conn;
764 struct rfcomm_conninfo cinfo;
765 int len, err = 0;
766 u32 opt;
767
768 BT_DBG("sk %p", sk);
769
770 if (get_user(len, optlen))
771 return -EFAULT;
772
773 lock_sock(sk);
774
775 switch (optname) {
776 case RFCOMM_LM:
777 switch (rfcomm_pi(sk)->sec_level) {
778 case BT_SECURITY_LOW:
779 opt = RFCOMM_LM_AUTH;
780 break;
781 case BT_SECURITY_MEDIUM:
782 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
783 break;
784 case BT_SECURITY_HIGH:
785 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
786 RFCOMM_LM_SECURE;
787 break;
788 case BT_SECURITY_FIPS:
789 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
790 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
791 break;
792 default:
793 opt = 0;
794 break;
795 }
796
797 if (rfcomm_pi(sk)->role_switch)
798 opt |= RFCOMM_LM_MASTER;
799
800 if (put_user(opt, (u32 __user *) optval))
801 err = -EFAULT;
802
803 break;
804
805 case RFCOMM_CONNINFO:
806 if (sk->sk_state != BT_CONNECTED &&
807 !rfcomm_pi(sk)->dlc->defer_setup) {
808 err = -ENOTCONN;
809 break;
810 }
811
812 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
813 conn = l2cap_pi(l2cap_sk)->chan->conn;
814
815 memset(&cinfo, 0, sizeof(cinfo));
816 cinfo.hci_handle = conn->hcon->handle;
817 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
818
819 len = min_t(unsigned int, len, sizeof(cinfo));
820 if (copy_to_user(optval, (char *) &cinfo, len))
821 err = -EFAULT;
822
823 break;
824
825 default:
826 err = -ENOPROTOOPT;
827 break;
828 }
829
830 release_sock(sk);
831 return err;
832}
833
834static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
835{
836 struct sock *sk = sock->sk;
837 struct bt_security sec;
838 int len, err = 0;
839
840 BT_DBG("sk %p", sk);
841
842 if (level == SOL_RFCOMM)
843 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
844
845 if (level != SOL_BLUETOOTH)
846 return -ENOPROTOOPT;
847
848 if (get_user(len, optlen))
849 return -EFAULT;
850
851 lock_sock(sk);
852
853 switch (optname) {
854 case BT_SECURITY:
855 if (sk->sk_type != SOCK_STREAM) {
856 err = -EINVAL;
857 break;
858 }
859
860 sec.level = rfcomm_pi(sk)->sec_level;
861 sec.key_size = 0;
862
863 len = min_t(unsigned int, len, sizeof(sec));
864 if (copy_to_user(optval, (char *) &sec, len))
865 err = -EFAULT;
866
867 break;
868
869 case BT_DEFER_SETUP:
870 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
871 err = -EINVAL;
872 break;
873 }
874
875 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
876 (u32 __user *) optval))
877 err = -EFAULT;
878
879 break;
880
881 default:
882 err = -ENOPROTOOPT;
883 break;
884 }
885
886 release_sock(sk);
887 return err;
888}
889
890static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
891{
892 struct sock *sk __maybe_unused = sock->sk;
893 int err;
894
895 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
896
897 err = bt_sock_ioctl(sock, cmd, arg);
898
899 if (err == -ENOIOCTLCMD) {
900#ifdef CONFIG_BT_RFCOMM_TTY
901 lock_sock(sk);
902 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
903 release_sock(sk);
904#else
905 err = -EOPNOTSUPP;
906#endif
907 }
908
909 return err;
910}
911
912static int rfcomm_sock_shutdown(struct socket *sock, int how)
913{
914 struct sock *sk = sock->sk;
915 int err = 0;
916
917 BT_DBG("sock %p, sk %p", sock, sk);
918
919 if (!sk)
920 return 0;
921
922 lock_sock(sk);
923 if (!sk->sk_shutdown) {
924 sk->sk_shutdown = SHUTDOWN_MASK;
925 __rfcomm_sock_close(sk);
926
927 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
928 !(current->flags & PF_EXITING))
929 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
930 }
931 release_sock(sk);
932 return err;
933}
934
935static int rfcomm_sock_release(struct socket *sock)
936{
937 struct sock *sk = sock->sk;
938 int err;
939
940 BT_DBG("sock %p, sk %p", sock, sk);
941
942 if (!sk)
943 return 0;
944
945 err = rfcomm_sock_shutdown(sock, 2);
946
947 sock_orphan(sk);
948 rfcomm_sock_kill(sk);
949 return err;
950}
951
952/* ---- RFCOMM core layer callbacks ----
953 *
954 * called under rfcomm_lock()
955 */
956int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
957{
958 struct sock *sk, *parent;
959 bdaddr_t src, dst;
960 int result = 0;
961
962 BT_DBG("session %p channel %d", s, channel);
963
964 rfcomm_session_getaddr(s, &src, &dst);
965
966 /* Check if we have socket listening on channel */
967 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
968 if (!parent)
969 return 0;
970
971 bh_lock_sock(parent);
972
973 /* Check for backlog size */
974 if (sk_acceptq_is_full(parent)) {
975 BT_DBG("backlog full %d", parent->sk_ack_backlog);
976 goto done;
977 }
978
979 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
980 if (!sk)
981 goto done;
982
983 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
984
985 rfcomm_sock_init(sk, parent);
986 bacpy(&rfcomm_pi(sk)->src, &src);
987 bacpy(&rfcomm_pi(sk)->dst, &dst);
988 rfcomm_pi(sk)->channel = channel;
989
990 sk->sk_state = BT_CONFIG;
991 bt_accept_enqueue(parent, sk, true);
992
993 /* Accept connection and return socket DLC */
994 *d = rfcomm_pi(sk)->dlc;
995 result = 1;
996
997done:
998 bh_unlock_sock(parent);
999
1000 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1001 parent->sk_state_change(parent);
1002
1003 return result;
1004}
1005
1006static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1007{
1008 struct sock *sk;
1009
1010 read_lock(&rfcomm_sk_list.lock);
1011
1012 sk_for_each(sk, &rfcomm_sk_list.head) {
1013 seq_printf(f, "%pMR %pMR %d %d\n",
1014 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1015 sk->sk_state, rfcomm_pi(sk)->channel);
1016 }
1017
1018 read_unlock(&rfcomm_sk_list.lock);
1019
1020 return 0;
1021}
1022
1023DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1024
1025static struct dentry *rfcomm_sock_debugfs;
1026
1027static const struct proto_ops rfcomm_sock_ops = {
1028 .family = PF_BLUETOOTH,
1029 .owner = THIS_MODULE,
1030 .release = rfcomm_sock_release,
1031 .bind = rfcomm_sock_bind,
1032 .connect = rfcomm_sock_connect,
1033 .listen = rfcomm_sock_listen,
1034 .accept = rfcomm_sock_accept,
1035 .getname = rfcomm_sock_getname,
1036 .sendmsg = rfcomm_sock_sendmsg,
1037 .recvmsg = rfcomm_sock_recvmsg,
1038 .shutdown = rfcomm_sock_shutdown,
1039 .setsockopt = rfcomm_sock_setsockopt,
1040 .getsockopt = rfcomm_sock_getsockopt,
1041 .ioctl = rfcomm_sock_ioctl,
1042 .gettstamp = sock_gettstamp,
1043 .poll = bt_sock_poll,
1044 .socketpair = sock_no_socketpair,
1045 .mmap = sock_no_mmap
1046};
1047
1048static const struct net_proto_family rfcomm_sock_family_ops = {
1049 .family = PF_BLUETOOTH,
1050 .owner = THIS_MODULE,
1051 .create = rfcomm_sock_create
1052};
1053
1054int __init rfcomm_init_sockets(void)
1055{
1056 int err;
1057
1058 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1059
1060 err = proto_register(&rfcomm_proto, 0);
1061 if (err < 0)
1062 return err;
1063
1064 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1065 if (err < 0) {
1066 BT_ERR("RFCOMM socket layer registration failed");
1067 goto error;
1068 }
1069
1070 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1071 if (err < 0) {
1072 BT_ERR("Failed to create RFCOMM proc file");
1073 bt_sock_unregister(BTPROTO_RFCOMM);
1074 goto error;
1075 }
1076
1077 BT_INFO("RFCOMM socket layer initialized");
1078
1079 if (IS_ERR_OR_NULL(bt_debugfs))
1080 return 0;
1081
1082 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1083 bt_debugfs, NULL,
1084 &rfcomm_sock_debugfs_fops);
1085
1086 return 0;
1087
1088error:
1089 proto_unregister(&rfcomm_proto);
1090 return err;
1091}
1092
1093void __exit rfcomm_cleanup_sockets(void)
1094{
1095 bt_procfs_cleanup(&init_net, "rfcomm");
1096
1097 debugfs_remove(rfcomm_sock_debugfs);
1098
1099 bt_sock_unregister(BTPROTO_RFCOMM);
1100
1101 proto_unregister(&rfcomm_proto);
1102}
1/*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM sockets.
26 */
27#include <linux/compat.h>
28#include <linux/export.h>
29#include <linux/debugfs.h>
30#include <linux/sched/signal.h>
31
32#include <net/bluetooth/bluetooth.h>
33#include <net/bluetooth/hci_core.h>
34#include <net/bluetooth/l2cap.h>
35#include <net/bluetooth/rfcomm.h>
36
37static const struct proto_ops rfcomm_sock_ops;
38
39static struct bt_sock_list rfcomm_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
41};
42
43static void rfcomm_sock_close(struct sock *sk);
44static void rfcomm_sock_kill(struct sock *sk);
45
46/* ---- DLC callbacks ----
47 *
48 * called under rfcomm_dlc_lock()
49 */
50static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
51{
52 struct sock *sk = d->owner;
53 if (!sk)
54 return;
55
56 atomic_add(skb->len, &sk->sk_rmem_alloc);
57 skb_queue_tail(&sk->sk_receive_queue, skb);
58 sk->sk_data_ready(sk);
59
60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
61 rfcomm_dlc_throttle(d);
62}
63
64static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
65{
66 struct sock *sk = d->owner, *parent;
67
68 if (!sk)
69 return;
70
71 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
72
73 lock_sock(sk);
74
75 if (err)
76 sk->sk_err = err;
77
78 sk->sk_state = d->state;
79
80 parent = bt_sk(sk)->parent;
81 if (parent) {
82 if (d->state == BT_CLOSED) {
83 sock_set_flag(sk, SOCK_ZAPPED);
84 bt_accept_unlink(sk);
85 }
86 parent->sk_data_ready(parent);
87 } else {
88 if (d->state == BT_CONNECTED)
89 rfcomm_session_getaddr(d->session,
90 &rfcomm_pi(sk)->src, NULL);
91 sk->sk_state_change(sk);
92 }
93
94 release_sock(sk);
95
96 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
97 /* We have to drop DLC lock here, otherwise
98 * rfcomm_sock_destruct() will dead lock. */
99 rfcomm_dlc_unlock(d);
100 rfcomm_sock_kill(sk);
101 rfcomm_dlc_lock(d);
102 }
103}
104
105/* ---- Socket functions ---- */
106static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
107{
108 struct sock *sk = NULL;
109
110 sk_for_each(sk, &rfcomm_sk_list.head) {
111 if (rfcomm_pi(sk)->channel != channel)
112 continue;
113
114 if (bacmp(&rfcomm_pi(sk)->src, src))
115 continue;
116
117 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
118 break;
119 }
120
121 return sk ? sk : NULL;
122}
123
124/* Find socket with channel and source bdaddr.
125 * Returns closest match.
126 */
127static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
128{
129 struct sock *sk = NULL, *sk1 = NULL;
130
131 read_lock(&rfcomm_sk_list.lock);
132
133 sk_for_each(sk, &rfcomm_sk_list.head) {
134 if (state && sk->sk_state != state)
135 continue;
136
137 if (rfcomm_pi(sk)->channel == channel) {
138 /* Exact match. */
139 if (!bacmp(&rfcomm_pi(sk)->src, src))
140 break;
141
142 /* Closest match */
143 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
144 sk1 = sk;
145 }
146 }
147
148 read_unlock(&rfcomm_sk_list.lock);
149
150 return sk ? sk : sk1;
151}
152
153static void rfcomm_sock_destruct(struct sock *sk)
154{
155 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
156
157 BT_DBG("sk %p dlc %p", sk, d);
158
159 skb_queue_purge(&sk->sk_receive_queue);
160 skb_queue_purge(&sk->sk_write_queue);
161
162 rfcomm_dlc_lock(d);
163 rfcomm_pi(sk)->dlc = NULL;
164
165 /* Detach DLC if it's owned by this socket */
166 if (d->owner == sk)
167 d->owner = NULL;
168 rfcomm_dlc_unlock(d);
169
170 rfcomm_dlc_put(d);
171}
172
173static void rfcomm_sock_cleanup_listen(struct sock *parent)
174{
175 struct sock *sk;
176
177 BT_DBG("parent %p", parent);
178
179 /* Close not yet accepted dlcs */
180 while ((sk = bt_accept_dequeue(parent, NULL))) {
181 rfcomm_sock_close(sk);
182 rfcomm_sock_kill(sk);
183 }
184
185 parent->sk_state = BT_CLOSED;
186 sock_set_flag(parent, SOCK_ZAPPED);
187}
188
189/* Kill socket (only if zapped and orphan)
190 * Must be called on unlocked socket.
191 */
192static void rfcomm_sock_kill(struct sock *sk)
193{
194 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
195 return;
196
197 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
198
199 /* Kill poor orphan */
200 bt_sock_unlink(&rfcomm_sk_list, sk);
201 sock_set_flag(sk, SOCK_DEAD);
202 sock_put(sk);
203}
204
205static void __rfcomm_sock_close(struct sock *sk)
206{
207 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
208
209 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
210
211 switch (sk->sk_state) {
212 case BT_LISTEN:
213 rfcomm_sock_cleanup_listen(sk);
214 break;
215
216 case BT_CONNECT:
217 case BT_CONNECT2:
218 case BT_CONFIG:
219 case BT_CONNECTED:
220 rfcomm_dlc_close(d, 0);
221 fallthrough;
222
223 default:
224 sock_set_flag(sk, SOCK_ZAPPED);
225 break;
226 }
227}
228
229/* Close socket.
230 * Must be called on unlocked socket.
231 */
232static void rfcomm_sock_close(struct sock *sk)
233{
234 lock_sock(sk);
235 __rfcomm_sock_close(sk);
236 release_sock(sk);
237}
238
239static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
240{
241 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
242
243 BT_DBG("sk %p", sk);
244
245 if (parent) {
246 sk->sk_type = parent->sk_type;
247 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
248 &bt_sk(parent)->flags);
249
250 pi->sec_level = rfcomm_pi(parent)->sec_level;
251 pi->role_switch = rfcomm_pi(parent)->role_switch;
252
253 security_sk_clone(parent, sk);
254 } else {
255 pi->dlc->defer_setup = 0;
256
257 pi->sec_level = BT_SECURITY_LOW;
258 pi->role_switch = 0;
259 }
260
261 pi->dlc->sec_level = pi->sec_level;
262 pi->dlc->role_switch = pi->role_switch;
263}
264
265static struct proto rfcomm_proto = {
266 .name = "RFCOMM",
267 .owner = THIS_MODULE,
268 .obj_size = sizeof(struct rfcomm_pinfo)
269};
270
271static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,
272 int proto, gfp_t prio, int kern)
273{
274 struct rfcomm_dlc *d;
275 struct sock *sk;
276
277 d = rfcomm_dlc_alloc(prio);
278 if (!d)
279 return NULL;
280
281 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
282 if (!sk) {
283 rfcomm_dlc_free(d);
284 return NULL;
285 }
286
287 d->data_ready = rfcomm_sk_data_ready;
288 d->state_change = rfcomm_sk_state_change;
289
290 rfcomm_pi(sk)->dlc = d;
291 d->owner = sk;
292
293 sk->sk_destruct = rfcomm_sock_destruct;
294 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
295
296 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
297 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
298
299 bt_sock_link(&rfcomm_sk_list, sk);
300
301 BT_DBG("sk %p", sk);
302 return sk;
303}
304
305static int rfcomm_sock_create(struct net *net, struct socket *sock,
306 int protocol, int kern)
307{
308 struct sock *sk;
309
310 BT_DBG("sock %p", sock);
311
312 sock->state = SS_UNCONNECTED;
313
314 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
315 return -ESOCKTNOSUPPORT;
316
317 sock->ops = &rfcomm_sock_ops;
318
319 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
320 if (!sk)
321 return -ENOMEM;
322
323 rfcomm_sock_init(sk, NULL);
324 return 0;
325}
326
327static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
328{
329 struct sockaddr_rc sa;
330 struct sock *sk = sock->sk;
331 int len, err = 0;
332
333 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
334 addr->sa_family != AF_BLUETOOTH)
335 return -EINVAL;
336
337 memset(&sa, 0, sizeof(sa));
338 len = min_t(unsigned int, sizeof(sa), addr_len);
339 memcpy(&sa, addr, len);
340
341 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
342
343 lock_sock(sk);
344
345 if (sk->sk_state != BT_OPEN) {
346 err = -EBADFD;
347 goto done;
348 }
349
350 if (sk->sk_type != SOCK_STREAM) {
351 err = -EINVAL;
352 goto done;
353 }
354
355 write_lock(&rfcomm_sk_list.lock);
356
357 if (sa.rc_channel &&
358 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
359 err = -EADDRINUSE;
360 } else {
361 /* Save source address */
362 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
363 rfcomm_pi(sk)->channel = sa.rc_channel;
364 sk->sk_state = BT_BOUND;
365 }
366
367 write_unlock(&rfcomm_sk_list.lock);
368
369done:
370 release_sock(sk);
371 return err;
372}
373
374static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
375{
376 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
377 struct sock *sk = sock->sk;
378 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
379 int err = 0;
380
381 BT_DBG("sk %p", sk);
382
383 if (alen < sizeof(struct sockaddr_rc) ||
384 addr->sa_family != AF_BLUETOOTH)
385 return -EINVAL;
386
387 sock_hold(sk);
388 lock_sock(sk);
389
390 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
391 err = -EBADFD;
392 goto done;
393 }
394
395 if (sk->sk_type != SOCK_STREAM) {
396 err = -EINVAL;
397 goto done;
398 }
399
400 sk->sk_state = BT_CONNECT;
401 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
402 rfcomm_pi(sk)->channel = sa->rc_channel;
403
404 d->sec_level = rfcomm_pi(sk)->sec_level;
405 d->role_switch = rfcomm_pi(sk)->role_switch;
406
407 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */
408 release_sock(sk);
409 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
410 sa->rc_channel);
411 lock_sock(sk);
412 if (!err && !sock_flag(sk, SOCK_ZAPPED))
413 err = bt_sock_wait_state(sk, BT_CONNECTED,
414 sock_sndtimeo(sk, flags & O_NONBLOCK));
415
416done:
417 release_sock(sk);
418 sock_put(sk);
419 return err;
420}
421
422static int rfcomm_sock_listen(struct socket *sock, int backlog)
423{
424 struct sock *sk = sock->sk;
425 int err = 0;
426
427 BT_DBG("sk %p backlog %d", sk, backlog);
428
429 lock_sock(sk);
430
431 if (sk->sk_state != BT_BOUND) {
432 err = -EBADFD;
433 goto done;
434 }
435
436 if (sk->sk_type != SOCK_STREAM) {
437 err = -EINVAL;
438 goto done;
439 }
440
441 if (!rfcomm_pi(sk)->channel) {
442 bdaddr_t *src = &rfcomm_pi(sk)->src;
443 u8 channel;
444
445 err = -EINVAL;
446
447 write_lock(&rfcomm_sk_list.lock);
448
449 for (channel = 1; channel < 31; channel++)
450 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
451 rfcomm_pi(sk)->channel = channel;
452 err = 0;
453 break;
454 }
455
456 write_unlock(&rfcomm_sk_list.lock);
457
458 if (err < 0)
459 goto done;
460 }
461
462 sk->sk_max_ack_backlog = backlog;
463 sk->sk_ack_backlog = 0;
464 sk->sk_state = BT_LISTEN;
465
466done:
467 release_sock(sk);
468 return err;
469}
470
471static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock,
472 struct proto_accept_arg *arg)
473{
474 DEFINE_WAIT_FUNC(wait, woken_wake_function);
475 struct sock *sk = sock->sk, *nsk;
476 long timeo;
477 int err = 0;
478
479 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
480
481 if (sk->sk_type != SOCK_STREAM) {
482 err = -EINVAL;
483 goto done;
484 }
485
486 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
487
488 BT_DBG("sk %p timeo %ld", sk, timeo);
489
490 /* Wait for an incoming connection. (wake-one). */
491 add_wait_queue_exclusive(sk_sleep(sk), &wait);
492 while (1) {
493 if (sk->sk_state != BT_LISTEN) {
494 err = -EBADFD;
495 break;
496 }
497
498 nsk = bt_accept_dequeue(sk, newsock);
499 if (nsk)
500 break;
501
502 if (!timeo) {
503 err = -EAGAIN;
504 break;
505 }
506
507 if (signal_pending(current)) {
508 err = sock_intr_errno(timeo);
509 break;
510 }
511
512 release_sock(sk);
513
514 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
515
516 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
517 }
518 remove_wait_queue(sk_sleep(sk), &wait);
519
520 if (err)
521 goto done;
522
523 newsock->state = SS_CONNECTED;
524
525 BT_DBG("new socket %p", nsk);
526
527done:
528 release_sock(sk);
529 return err;
530}
531
532static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
533{
534 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
535 struct sock *sk = sock->sk;
536
537 BT_DBG("sock %p, sk %p", sock, sk);
538
539 if (peer && sk->sk_state != BT_CONNECTED &&
540 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
541 return -ENOTCONN;
542
543 memset(sa, 0, sizeof(*sa));
544 sa->rc_family = AF_BLUETOOTH;
545 sa->rc_channel = rfcomm_pi(sk)->channel;
546 if (peer)
547 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
548 else
549 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
550
551 return sizeof(struct sockaddr_rc);
552}
553
554static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
555 size_t len)
556{
557 struct sock *sk = sock->sk;
558 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
559 struct sk_buff *skb;
560 int sent;
561
562 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
563 return -ENOTCONN;
564
565 if (msg->msg_flags & MSG_OOB)
566 return -EOPNOTSUPP;
567
568 if (sk->sk_shutdown & SEND_SHUTDOWN)
569 return -EPIPE;
570
571 BT_DBG("sock %p, sk %p", sock, sk);
572
573 lock_sock(sk);
574
575 sent = bt_sock_wait_ready(sk, msg->msg_flags);
576
577 release_sock(sk);
578
579 if (sent)
580 return sent;
581
582 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
583 RFCOMM_SKB_TAIL_RESERVE);
584 if (IS_ERR(skb))
585 return PTR_ERR(skb);
586
587 sent = rfcomm_dlc_send(d, skb);
588 if (sent < 0)
589 kfree_skb(skb);
590
591 return sent;
592}
593
594static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
595 size_t size, int flags)
596{
597 struct sock *sk = sock->sk;
598 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
599 int len;
600
601 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
602 rfcomm_dlc_accept(d);
603 return 0;
604 }
605
606 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
607
608 lock_sock(sk);
609 if (!(flags & MSG_PEEK) && len > 0)
610 atomic_sub(len, &sk->sk_rmem_alloc);
611
612 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
613 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
614 release_sock(sk);
615
616 return len;
617}
618
619static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
620 sockptr_t optval, unsigned int optlen)
621{
622 struct sock *sk = sock->sk;
623 int err = 0;
624 u32 opt;
625
626 BT_DBG("sk %p", sk);
627
628 lock_sock(sk);
629
630 switch (optname) {
631 case RFCOMM_LM:
632 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
633 if (err)
634 break;
635
636 if (opt & RFCOMM_LM_FIPS) {
637 err = -EINVAL;
638 break;
639 }
640
641 if (opt & RFCOMM_LM_AUTH)
642 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
643 if (opt & RFCOMM_LM_ENCRYPT)
644 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
645 if (opt & RFCOMM_LM_SECURE)
646 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
647
648 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
649 break;
650
651 default:
652 err = -ENOPROTOOPT;
653 break;
654 }
655
656 release_sock(sk);
657 return err;
658}
659
660static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
661 sockptr_t optval, unsigned int optlen)
662{
663 struct sock *sk = sock->sk;
664 struct bt_security sec;
665 int err = 0;
666 u32 opt;
667
668 BT_DBG("sk %p", sk);
669
670 if (level == SOL_RFCOMM)
671 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
672
673 if (level != SOL_BLUETOOTH)
674 return -ENOPROTOOPT;
675
676 lock_sock(sk);
677
678 switch (optname) {
679 case BT_SECURITY:
680 if (sk->sk_type != SOCK_STREAM) {
681 err = -EINVAL;
682 break;
683 }
684
685 sec.level = BT_SECURITY_LOW;
686
687 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
688 if (err)
689 break;
690
691 if (sec.level > BT_SECURITY_HIGH) {
692 err = -EINVAL;
693 break;
694 }
695
696 rfcomm_pi(sk)->sec_level = sec.level;
697 break;
698
699 case BT_DEFER_SETUP:
700 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
701 err = -EINVAL;
702 break;
703 }
704
705 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
706 if (err)
707 break;
708
709 if (opt)
710 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
711 else
712 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
713
714 break;
715
716 default:
717 err = -ENOPROTOOPT;
718 break;
719 }
720
721 release_sock(sk);
722 return err;
723}
724
725static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
726{
727 struct sock *sk = sock->sk;
728 struct sock *l2cap_sk;
729 struct l2cap_conn *conn;
730 struct rfcomm_conninfo cinfo;
731 int err = 0;
732 size_t len;
733 u32 opt;
734
735 BT_DBG("sk %p", sk);
736
737 if (get_user(len, optlen))
738 return -EFAULT;
739
740 lock_sock(sk);
741
742 switch (optname) {
743 case RFCOMM_LM:
744 switch (rfcomm_pi(sk)->sec_level) {
745 case BT_SECURITY_LOW:
746 opt = RFCOMM_LM_AUTH;
747 break;
748 case BT_SECURITY_MEDIUM:
749 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
750 break;
751 case BT_SECURITY_HIGH:
752 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
753 RFCOMM_LM_SECURE;
754 break;
755 case BT_SECURITY_FIPS:
756 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
757 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
758 break;
759 default:
760 opt = 0;
761 break;
762 }
763
764 if (rfcomm_pi(sk)->role_switch)
765 opt |= RFCOMM_LM_MASTER;
766
767 if (put_user(opt, (u32 __user *) optval))
768 err = -EFAULT;
769
770 break;
771
772 case RFCOMM_CONNINFO:
773 if (sk->sk_state != BT_CONNECTED &&
774 !rfcomm_pi(sk)->dlc->defer_setup) {
775 err = -ENOTCONN;
776 break;
777 }
778
779 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
780 conn = l2cap_pi(l2cap_sk)->chan->conn;
781
782 memset(&cinfo, 0, sizeof(cinfo));
783 cinfo.hci_handle = conn->hcon->handle;
784 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
785
786 len = min(len, sizeof(cinfo));
787 if (copy_to_user(optval, (char *) &cinfo, len))
788 err = -EFAULT;
789
790 break;
791
792 default:
793 err = -ENOPROTOOPT;
794 break;
795 }
796
797 release_sock(sk);
798 return err;
799}
800
801static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
802{
803 struct sock *sk = sock->sk;
804 struct bt_security sec;
805 int err = 0;
806 size_t len;
807
808 BT_DBG("sk %p", sk);
809
810 if (level == SOL_RFCOMM)
811 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
812
813 if (level != SOL_BLUETOOTH)
814 return -ENOPROTOOPT;
815
816 if (get_user(len, optlen))
817 return -EFAULT;
818
819 lock_sock(sk);
820
821 switch (optname) {
822 case BT_SECURITY:
823 if (sk->sk_type != SOCK_STREAM) {
824 err = -EINVAL;
825 break;
826 }
827
828 sec.level = rfcomm_pi(sk)->sec_level;
829 sec.key_size = 0;
830
831 len = min(len, sizeof(sec));
832 if (copy_to_user(optval, (char *) &sec, len))
833 err = -EFAULT;
834
835 break;
836
837 case BT_DEFER_SETUP:
838 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
839 err = -EINVAL;
840 break;
841 }
842
843 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
844 (u32 __user *) optval))
845 err = -EFAULT;
846
847 break;
848
849 default:
850 err = -ENOPROTOOPT;
851 break;
852 }
853
854 release_sock(sk);
855 return err;
856}
857
858static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
859{
860 struct sock *sk __maybe_unused = sock->sk;
861 int err;
862
863 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
864
865 err = bt_sock_ioctl(sock, cmd, arg);
866
867 if (err == -ENOIOCTLCMD) {
868#ifdef CONFIG_BT_RFCOMM_TTY
869 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
870#else
871 err = -EOPNOTSUPP;
872#endif
873 }
874
875 return err;
876}
877
878#ifdef CONFIG_COMPAT
879static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
880{
881 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
882}
883#endif
884
885static int rfcomm_sock_shutdown(struct socket *sock, int how)
886{
887 struct sock *sk = sock->sk;
888 int err = 0;
889
890 BT_DBG("sock %p, sk %p", sock, sk);
891
892 if (!sk)
893 return 0;
894
895 lock_sock(sk);
896 if (!sk->sk_shutdown) {
897 sk->sk_shutdown = SHUTDOWN_MASK;
898
899 release_sock(sk);
900 __rfcomm_sock_close(sk);
901 lock_sock(sk);
902
903 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
904 !(current->flags & PF_EXITING))
905 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
906 }
907 release_sock(sk);
908 return err;
909}
910
911static int rfcomm_sock_release(struct socket *sock)
912{
913 struct sock *sk = sock->sk;
914 int err;
915
916 BT_DBG("sock %p, sk %p", sock, sk);
917
918 if (!sk)
919 return 0;
920
921 err = rfcomm_sock_shutdown(sock, 2);
922
923 sock_orphan(sk);
924 rfcomm_sock_kill(sk);
925 return err;
926}
927
928/* ---- RFCOMM core layer callbacks ----
929 *
930 * called under rfcomm_lock()
931 */
932int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
933{
934 struct sock *sk, *parent;
935 bdaddr_t src, dst;
936 int result = 0;
937
938 BT_DBG("session %p channel %d", s, channel);
939
940 rfcomm_session_getaddr(s, &src, &dst);
941
942 /* Check if we have socket listening on channel */
943 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
944 if (!parent)
945 return 0;
946
947 lock_sock(parent);
948
949 /* Check for backlog size */
950 if (sk_acceptq_is_full(parent)) {
951 BT_DBG("backlog full %d", parent->sk_ack_backlog);
952 goto done;
953 }
954
955 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
956 if (!sk)
957 goto done;
958
959 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
960
961 rfcomm_sock_init(sk, parent);
962 bacpy(&rfcomm_pi(sk)->src, &src);
963 bacpy(&rfcomm_pi(sk)->dst, &dst);
964 rfcomm_pi(sk)->channel = channel;
965
966 sk->sk_state = BT_CONFIG;
967 bt_accept_enqueue(parent, sk, true);
968
969 /* Accept connection and return socket DLC */
970 *d = rfcomm_pi(sk)->dlc;
971 result = 1;
972
973done:
974 release_sock(parent);
975
976 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
977 parent->sk_state_change(parent);
978
979 return result;
980}
981
982static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
983{
984 struct sock *sk;
985
986 read_lock(&rfcomm_sk_list.lock);
987
988 sk_for_each(sk, &rfcomm_sk_list.head) {
989 seq_printf(f, "%pMR %pMR %d %d\n",
990 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
991 sk->sk_state, rfcomm_pi(sk)->channel);
992 }
993
994 read_unlock(&rfcomm_sk_list.lock);
995
996 return 0;
997}
998
999DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1000
1001static struct dentry *rfcomm_sock_debugfs;
1002
1003static const struct proto_ops rfcomm_sock_ops = {
1004 .family = PF_BLUETOOTH,
1005 .owner = THIS_MODULE,
1006 .release = rfcomm_sock_release,
1007 .bind = rfcomm_sock_bind,
1008 .connect = rfcomm_sock_connect,
1009 .listen = rfcomm_sock_listen,
1010 .accept = rfcomm_sock_accept,
1011 .getname = rfcomm_sock_getname,
1012 .sendmsg = rfcomm_sock_sendmsg,
1013 .recvmsg = rfcomm_sock_recvmsg,
1014 .shutdown = rfcomm_sock_shutdown,
1015 .setsockopt = rfcomm_sock_setsockopt,
1016 .getsockopt = rfcomm_sock_getsockopt,
1017 .ioctl = rfcomm_sock_ioctl,
1018 .gettstamp = sock_gettstamp,
1019 .poll = bt_sock_poll,
1020 .socketpair = sock_no_socketpair,
1021 .mmap = sock_no_mmap,
1022#ifdef CONFIG_COMPAT
1023 .compat_ioctl = rfcomm_sock_compat_ioctl,
1024#endif
1025};
1026
1027static const struct net_proto_family rfcomm_sock_family_ops = {
1028 .family = PF_BLUETOOTH,
1029 .owner = THIS_MODULE,
1030 .create = rfcomm_sock_create
1031};
1032
1033int __init rfcomm_init_sockets(void)
1034{
1035 int err;
1036
1037 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1038
1039 err = proto_register(&rfcomm_proto, 0);
1040 if (err < 0)
1041 return err;
1042
1043 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1044 if (err < 0) {
1045 BT_ERR("RFCOMM socket layer registration failed");
1046 goto error;
1047 }
1048
1049 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1050 if (err < 0) {
1051 BT_ERR("Failed to create RFCOMM proc file");
1052 bt_sock_unregister(BTPROTO_RFCOMM);
1053 goto error;
1054 }
1055
1056 BT_INFO("RFCOMM socket layer initialized");
1057
1058 if (IS_ERR_OR_NULL(bt_debugfs))
1059 return 0;
1060
1061 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1062 bt_debugfs, NULL,
1063 &rfcomm_sock_debugfs_fops);
1064
1065 return 0;
1066
1067error:
1068 proto_unregister(&rfcomm_proto);
1069 return err;
1070}
1071
1072void __exit rfcomm_cleanup_sockets(void)
1073{
1074 bt_procfs_cleanup(&init_net, "rfcomm");
1075
1076 debugfs_remove(rfcomm_sock_debugfs);
1077
1078 bt_sock_unregister(BTPROTO_RFCOMM);
1079
1080 proto_unregister(&rfcomm_proto);
1081}