net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27 #include <linux/compat.h>
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/sched/signal.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/l2cap.h>
  35 #include <net/bluetooth/rfcomm.h>
  36
  37 static const struct proto_ops rfcomm_sock_ops;
  38
  39 static struct bt_sock_list rfcomm_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  41 };
  42
  43 static void rfcomm_sock_close(struct sock *sk);
  44 static void rfcomm_sock_kill(struct sock *sk);
  45
  46 /* ---- DLC callbacks ----
  47  *
  48  * called under rfcomm_dlc_lock()
  49  */
  50 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  51 {
  52         struct sock *sk = d->owner;
  53         if (!sk)
  54                 return;
  55
  56         atomic_add(skb->len, &sk->sk_rmem_alloc);
  57         skb_queue_tail(&sk->sk_receive_queue, skb);
  58         sk->sk_data_ready(sk);
  59
  60         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  61                 rfcomm_dlc_throttle(d);
  62 }
  63
  64 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  65 {
  66         struct sock *sk = d->owner, *parent;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         lock_sock(sk);
  74
  75         if (err)
  76                 sk->sk_err = err;
  77
  78         sk->sk_state = d->state;
  79
  80         parent = bt_sk(sk)->parent;
  81         if (parent) {
  82                 if (d->state == BT_CLOSED) {
  83                         sock_set_flag(sk, SOCK_ZAPPED);
  84                         bt_accept_unlink(sk);
  85                 }
  86                 parent->sk_data_ready(parent);
  87         } else {
  88                 if (d->state == BT_CONNECTED)
  89                         rfcomm_session_getaddr(d->session,
  90                                                &rfcomm_pi(sk)->src, NULL);
  91                 sk->sk_state_change(sk);
  92         }
  93
  94         release_sock(sk);
  95
  96         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  97                 /* We have to drop DLC lock here, otherwise
  98                  * rfcomm_sock_destruct() will dead lock. */
  99                 rfcomm_dlc_unlock(d);
 100                 rfcomm_sock_kill(sk);
 101                 rfcomm_dlc_lock(d);
 102         }
 103 }
 104
 105 /* ---- Socket functions ---- */
 106 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
 107 {
 108         struct sock *sk = NULL;
 109
 110         sk_for_each(sk, &rfcomm_sk_list.head) {
 111                 if (rfcomm_pi(sk)->channel != channel)
 112                         continue;
 113
 114                 if (bacmp(&rfcomm_pi(sk)->src, src))
 115                         continue;
 116
 117                 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
 118                         break;
 119         }
 120
 121         return sk ? sk : NULL;
 122 }
 123
 124 /* Find socket with channel and source bdaddr.
 125  * Returns closest match.
 126  */
 127 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 128 {
 129         struct sock *sk = NULL, *sk1 = NULL;
 130
 131         read_lock(&rfcomm_sk_list.lock);
 132
 133         sk_for_each(sk, &rfcomm_sk_list.head) {
 134                 if (state && sk->sk_state != state)
 135                         continue;
 136
 137                 if (rfcomm_pi(sk)->channel == channel) {
 138                         /* Exact match. */
 139                         if (!bacmp(&rfcomm_pi(sk)->src, src))
 140                                 break;
 141
 142                         /* Closest match */
 143                         if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
 144                                 sk1 = sk;
 145                 }
 146         }
 147
 148         read_unlock(&rfcomm_sk_list.lock);
 149
 150         return sk ? sk : sk1;
 151 }
 152
 153 static void rfcomm_sock_destruct(struct sock *sk)
 154 {
 155         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 156
 157         BT_DBG("sk %p dlc %p", sk, d);
 158
 159         skb_queue_purge(&sk->sk_receive_queue);
 160         skb_queue_purge(&sk->sk_write_queue);
 161
 162         rfcomm_dlc_lock(d);
 163         rfcomm_pi(sk)->dlc = NULL;
 164
 165         /* Detach DLC if it's owned by this socket */
 166         if (d->owner == sk)
 167                 d->owner = NULL;
 168         rfcomm_dlc_unlock(d);
 169
 170         rfcomm_dlc_put(d);
 171 }
 172
 173 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 174 {
 175         struct sock *sk;
 176
 177         BT_DBG("parent %p", parent);
 178
 179         /* Close not yet accepted dlcs */
 180         while ((sk = bt_accept_dequeue(parent, NULL))) {
 181                 rfcomm_sock_close(sk);
 182                 rfcomm_sock_kill(sk);
 183         }
 184
 185         parent->sk_state  = BT_CLOSED;
 186         sock_set_flag(parent, SOCK_ZAPPED);
 187 }
 188
 189 /* Kill socket (only if zapped and orphan)
 190  * Must be called on unlocked socket.
 191  */
 192 static void rfcomm_sock_kill(struct sock *sk)
 193 {
 194         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 195                 return;
 196
 197         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
 198
 199         /* Kill poor orphan */
 200         bt_sock_unlink(&rfcomm_sk_list, sk);
 201         sock_set_flag(sk, SOCK_DEAD);
 202         sock_put(sk);
 203 }
 204
 205 static void __rfcomm_sock_close(struct sock *sk)
 206 {
 207         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 208
 209         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 210
 211         switch (sk->sk_state) {
 212         case BT_LISTEN:
 213                 rfcomm_sock_cleanup_listen(sk);
 214                 break;
 215
 216         case BT_CONNECT:
 217         case BT_CONNECT2:
 218         case BT_CONFIG:
 219         case BT_CONNECTED:
 220                 rfcomm_dlc_close(d, 0);
 221                 fallthrough;
 222
 223         default:
 224                 sock_set_flag(sk, SOCK_ZAPPED);
 225                 break;
 226         }
 227 }
 228
 229 /* Close socket.
 230  * Must be called on unlocked socket.
 231  */
 232 static void rfcomm_sock_close(struct sock *sk)
 233 {
 234         lock_sock(sk);
 235         __rfcomm_sock_close(sk);
 236         release_sock(sk);
 237 }
 238
 239 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 240 {
 241         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 242
 243         BT_DBG("sk %p", sk);
 244
 245         if (parent) {
 246                 sk->sk_type = parent->sk_type;
 247                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 248                                                 &bt_sk(parent)->flags);
 249
 250                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 251                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 252
 253                 security_sk_clone(parent, sk);
 254         } else {
 255                 pi->dlc->defer_setup = 0;
 256
 257                 pi->sec_level = BT_SECURITY_LOW;
 258                 pi->role_switch = 0;
 259         }
 260
 261         pi->dlc->sec_level = pi->sec_level;
 262         pi->dlc->role_switch = pi->role_switch;
 263 }
 264
 265 static struct proto rfcomm_proto = {
 266         .name           = "RFCOMM",
 267         .owner          = THIS_MODULE,
 268         .obj_size       = sizeof(struct rfcomm_pinfo)
 269 };
 270
 271 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,
 272                                       int proto, gfp_t prio, int kern)
 273 {
 274         struct rfcomm_dlc *d;
 275         struct sock *sk;
 276
 277         sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
 278         if (!sk)
 279                 return NULL;
 280
 281         d = rfcomm_dlc_alloc(prio);
 282         if (!d) {
 283                 sk_free(sk);
 284                 return NULL;
 285         }
 286
 287         d->data_ready   = rfcomm_sk_data_ready;
 288         d->state_change = rfcomm_sk_state_change;
 289
 290         rfcomm_pi(sk)->dlc = d;
 291         d->owner = sk;
 292
 293         sk->sk_destruct = rfcomm_sock_destruct;
 294         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 295
 296         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 297         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 298
 299         bt_sock_link(&rfcomm_sk_list, sk);
 300
 301         BT_DBG("sk %p", sk);
 302         return sk;
 303 }
 304
 305 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 306                               int protocol, int kern)
 307 {
 308         struct sock *sk;
 309
 310         BT_DBG("sock %p", sock);
 311
 312         sock->state = SS_UNCONNECTED;
 313
 314         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 315                 return -ESOCKTNOSUPPORT;
 316
 317         sock->ops = &rfcomm_sock_ops;
 318
 319         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
 320         if (!sk)
 321                 return -ENOMEM;
 322
 323         rfcomm_sock_init(sk, NULL);
 324         return 0;
 325 }
 326
 327 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 328 {
 329         struct sockaddr_rc sa;
 330         struct sock *sk = sock->sk;
 331         int len, err = 0;
 332
 333         if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
 334             addr->sa_family != AF_BLUETOOTH)
 335                 return -EINVAL;
 336
 337         memset(&sa, 0, sizeof(sa));
 338         len = min_t(unsigned int, sizeof(sa), addr_len);
 339         memcpy(&sa, addr, len);
 340
 341         BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
 342
 343         lock_sock(sk);
 344
 345         if (sk->sk_state != BT_OPEN) {
 346                 err = -EBADFD;
 347                 goto done;
 348         }
 349
 350         if (sk->sk_type != SOCK_STREAM) {
 351                 err = -EINVAL;
 352                 goto done;
 353         }
 354
 355         write_lock(&rfcomm_sk_list.lock);
 356
 357         if (sa.rc_channel &&
 358             __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
 359                 err = -EADDRINUSE;
 360         } else {
 361                 /* Save source address */
 362                 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
 363                 rfcomm_pi(sk)->channel = sa.rc_channel;
 364                 sk->sk_state = BT_BOUND;
 365         }
 366
 367         write_unlock(&rfcomm_sk_list.lock);
 368
 369 done:
 370         release_sock(sk);
 371         return err;
 372 }
 373
 374 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 375 {
 376         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 377         struct sock *sk = sock->sk;
 378         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 379         int err = 0;
 380
 381         BT_DBG("sk %p", sk);
 382
 383         if (alen < sizeof(struct sockaddr_rc) ||
 384             addr->sa_family != AF_BLUETOOTH)
 385                 return -EINVAL;
 386
 387         sock_hold(sk);
 388         lock_sock(sk);
 389
 390         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 391                 err = -EBADFD;
 392                 goto done;
 393         }
 394
 395         if (sk->sk_type != SOCK_STREAM) {
 396                 err = -EINVAL;
 397                 goto done;
 398         }
 399
 400         sk->sk_state = BT_CONNECT;
 401         bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
 402         rfcomm_pi(sk)->channel = sa->rc_channel;
 403
 404         d->sec_level = rfcomm_pi(sk)->sec_level;
 405         d->role_switch = rfcomm_pi(sk)->role_switch;
 406
 407         /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */
 408         release_sock(sk);
 409         err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
 410                               sa->rc_channel);
 411         lock_sock(sk);
 412         if (!err && !sock_flag(sk, SOCK_ZAPPED))
 413                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 414                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 415
 416 done:
 417         release_sock(sk);
 418         sock_put(sk);
 419         return err;
 420 }
 421
 422 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 423 {
 424         struct sock *sk = sock->sk;
 425         int err = 0;
 426
 427         BT_DBG("sk %p backlog %d", sk, backlog);
 428
 429         lock_sock(sk);
 430
 431         if (sk->sk_state != BT_BOUND) {
 432                 err = -EBADFD;
 433                 goto done;
 434         }
 435
 436         if (sk->sk_type != SOCK_STREAM) {
 437                 err = -EINVAL;
 438                 goto done;
 439         }
 440
 441         if (!rfcomm_pi(sk)->channel) {
 442                 bdaddr_t *src = &rfcomm_pi(sk)->src;
 443                 u8 channel;
 444
 445                 err = -EINVAL;
 446
 447                 write_lock(&rfcomm_sk_list.lock);
 448
 449                 for (channel = 1; channel < 31; channel++)
 450                         if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
 451                                 rfcomm_pi(sk)->channel = channel;
 452                                 err = 0;
 453                                 break;
 454                         }
 455
 456                 write_unlock(&rfcomm_sk_list.lock);
 457
 458                 if (err < 0)
 459                         goto done;
 460         }
 461
 462         sk->sk_max_ack_backlog = backlog;
 463         sk->sk_ack_backlog = 0;
 464         sk->sk_state = BT_LISTEN;
 465
 466 done:
 467         release_sock(sk);
 468         return err;
 469 }
 470
 471 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
 472                               bool kern)
 473 {
 474         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 475         struct sock *sk = sock->sk, *nsk;
 476         long timeo;
 477         int err = 0;
 478
 479         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 480
 481         if (sk->sk_type != SOCK_STREAM) {
 482                 err = -EINVAL;
 483                 goto done;
 484         }
 485
 486         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 487
 488         BT_DBG("sk %p timeo %ld", sk, timeo);
 489
 490         /* Wait for an incoming connection. (wake-one). */
 491         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 492         while (1) {
 493                 if (sk->sk_state != BT_LISTEN) {
 494                         err = -EBADFD;
 495                         break;
 496                 }
 497
 498                 nsk = bt_accept_dequeue(sk, newsock);
 499                 if (nsk)
 500                         break;
 501
 502                 if (!timeo) {
 503                         err = -EAGAIN;
 504                         break;
 505                 }
 506
 507                 if (signal_pending(current)) {
 508                         err = sock_intr_errno(timeo);
 509                         break;
 510                 }
 511
 512                 release_sock(sk);
 513
 514                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 515
 516                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 517         }
 518         remove_wait_queue(sk_sleep(sk), &wait);
 519
 520         if (err)
 521                 goto done;
 522
 523         newsock->state = SS_CONNECTED;
 524
 525         BT_DBG("new socket %p", nsk);
 526
 527 done:
 528         release_sock(sk);
 529         return err;
 530 }
 531
 532 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
 533 {
 534         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 535         struct sock *sk = sock->sk;
 536
 537         BT_DBG("sock %p, sk %p", sock, sk);
 538
 539         if (peer && sk->sk_state != BT_CONNECTED &&
 540             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
 541                 return -ENOTCONN;
 542
 543         memset(sa, 0, sizeof(*sa));
 544         sa->rc_family  = AF_BLUETOOTH;
 545         sa->rc_channel = rfcomm_pi(sk)->channel;
 546         if (peer)
 547                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
 548         else
 549                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 550
 551         return sizeof(struct sockaddr_rc);
 552 }
 553
 554 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 555                                size_t len)
 556 {
 557         struct sock *sk = sock->sk;
 558         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 559         struct sk_buff *skb;
 560         int sent;
 561
 562         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 563                 return -ENOTCONN;
 564
 565         if (msg->msg_flags & MSG_OOB)
 566                 return -EOPNOTSUPP;
 567
 568         if (sk->sk_shutdown & SEND_SHUTDOWN)
 569                 return -EPIPE;
 570
 571         BT_DBG("sock %p, sk %p", sock, sk);
 572
 573         lock_sock(sk);
 574
 575         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 576
 577         release_sock(sk);
 578
 579         if (sent)
 580                 return sent;
 581
 582         skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
 583                               RFCOMM_SKB_TAIL_RESERVE);
 584         if (IS_ERR(skb))
 585                 return PTR_ERR(skb);
 586
 587         sent = rfcomm_dlc_send(d, skb);
 588         if (sent < 0)
 589                 kfree_skb(skb);
 590
 591         return sent;
 592 }
 593
 594 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 595                                size_t size, int flags)
 596 {
 597         struct sock *sk = sock->sk;
 598         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 599         int len;
 600
 601         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 602                 rfcomm_dlc_accept(d);
 603                 return 0;
 604         }
 605
 606         len = bt_sock_stream_recvmsg(sock, msg, size, flags);
 607
 608         lock_sock(sk);
 609         if (!(flags & MSG_PEEK) && len > 0)
 610                 atomic_sub(len, &sk->sk_rmem_alloc);
 611
 612         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 613                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 614         release_sock(sk);
 615
 616         return len;
 617 }
 618
 619 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
 620                 sockptr_t optval, unsigned int optlen)
 621 {
 622         struct sock *sk = sock->sk;
 623         int err = 0;
 624         u32 opt;
 625
 626         BT_DBG("sk %p", sk);
 627
 628         lock_sock(sk);
 629
 630         switch (optname) {
 631         case RFCOMM_LM:
 632                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 633                         err = -EFAULT;
 634                         break;
 635                 }
 636
 637                 if (opt & RFCOMM_LM_FIPS) {
 638                         err = -EINVAL;
 639                         break;
 640                 }
 641
 642                 if (opt & RFCOMM_LM_AUTH)
 643                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 644                 if (opt & RFCOMM_LM_ENCRYPT)
 645                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 646                 if (opt & RFCOMM_LM_SECURE)
 647                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 648
 649                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 650                 break;
 651
 652         default:
 653                 err = -ENOPROTOOPT;
 654                 break;
 655         }
 656
 657         release_sock(sk);
 658         return err;
 659 }
 660
 661 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
 662                 sockptr_t optval, unsigned int optlen)
 663 {
 664         struct sock *sk = sock->sk;
 665         struct bt_security sec;
 666         int err = 0;
 667         size_t len;
 668         u32 opt;
 669
 670         BT_DBG("sk %p", sk);
 671
 672         if (level == SOL_RFCOMM)
 673                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 674
 675         if (level != SOL_BLUETOOTH)
 676                 return -ENOPROTOOPT;
 677
 678         lock_sock(sk);
 679
 680         switch (optname) {
 681         case BT_SECURITY:
 682                 if (sk->sk_type != SOCK_STREAM) {
 683                         err = -EINVAL;
 684                         break;
 685                 }
 686
 687                 sec.level = BT_SECURITY_LOW;
 688
 689                 len = min_t(unsigned int, sizeof(sec), optlen);
 690                 if (copy_from_sockptr(&sec, optval, len)) {
 691                         err = -EFAULT;
 692                         break;
 693                 }
 694
 695                 if (sec.level > BT_SECURITY_HIGH) {
 696                         err = -EINVAL;
 697                         break;
 698                 }
 699
 700                 rfcomm_pi(sk)->sec_level = sec.level;
 701                 break;
 702
 703         case BT_DEFER_SETUP:
 704                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 705                         err = -EINVAL;
 706                         break;
 707                 }
 708
 709                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 710                         err = -EFAULT;
 711                         break;
 712                 }
 713
 714                 if (opt)
 715                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 716                 else
 717                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 718
 719                 break;
 720
 721         default:
 722                 err = -ENOPROTOOPT;
 723                 break;
 724         }
 725
 726         release_sock(sk);
 727         return err;
 728 }
 729
 730 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 731 {
 732         struct sock *sk = sock->sk;
 733         struct sock *l2cap_sk;
 734         struct l2cap_conn *conn;
 735         struct rfcomm_conninfo cinfo;
 736         int len, err = 0;
 737         u32 opt;
 738
 739         BT_DBG("sk %p", sk);
 740
 741         if (get_user(len, optlen))
 742                 return -EFAULT;
 743
 744         lock_sock(sk);
 745
 746         switch (optname) {
 747         case RFCOMM_LM:
 748                 switch (rfcomm_pi(sk)->sec_level) {
 749                 case BT_SECURITY_LOW:
 750                         opt = RFCOMM_LM_AUTH;
 751                         break;
 752                 case BT_SECURITY_MEDIUM:
 753                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 754                         break;
 755                 case BT_SECURITY_HIGH:
 756                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 757                               RFCOMM_LM_SECURE;
 758                         break;
 759                 case BT_SECURITY_FIPS:
 760                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 761                               RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
 762                         break;
 763                 default:
 764                         opt = 0;
 765                         break;
 766                 }
 767
 768                 if (rfcomm_pi(sk)->role_switch)
 769                         opt |= RFCOMM_LM_MASTER;
 770
 771                 if (put_user(opt, (u32 __user *) optval))
 772                         err = -EFAULT;
 773
 774                 break;
 775
 776         case RFCOMM_CONNINFO:
 777                 if (sk->sk_state != BT_CONNECTED &&
 778                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 779                         err = -ENOTCONN;
 780                         break;
 781                 }
 782
 783                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 784                 conn = l2cap_pi(l2cap_sk)->chan->conn;
 785
 786                 memset(&cinfo, 0, sizeof(cinfo));
 787                 cinfo.hci_handle = conn->hcon->handle;
 788                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 789
 790                 len = min_t(unsigned int, len, sizeof(cinfo));
 791                 if (copy_to_user(optval, (char *) &cinfo, len))
 792                         err = -EFAULT;
 793
 794                 break;
 795
 796         default:
 797                 err = -ENOPROTOOPT;
 798                 break;
 799         }
 800
 801         release_sock(sk);
 802         return err;
 803 }
 804
 805 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 806 {
 807         struct sock *sk = sock->sk;
 808         struct bt_security sec;
 809         int len, err = 0;
 810
 811         BT_DBG("sk %p", sk);
 812
 813         if (level == SOL_RFCOMM)
 814                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 815
 816         if (level != SOL_BLUETOOTH)
 817                 return -ENOPROTOOPT;
 818
 819         if (get_user(len, optlen))
 820                 return -EFAULT;
 821
 822         lock_sock(sk);
 823
 824         switch (optname) {
 825         case BT_SECURITY:
 826                 if (sk->sk_type != SOCK_STREAM) {
 827                         err = -EINVAL;
 828                         break;
 829                 }
 830
 831                 sec.level = rfcomm_pi(sk)->sec_level;
 832                 sec.key_size = 0;
 833
 834                 len = min_t(unsigned int, len, sizeof(sec));
 835                 if (copy_to_user(optval, (char *) &sec, len))
 836                         err = -EFAULT;
 837
 838                 break;
 839
 840         case BT_DEFER_SETUP:
 841                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 842                         err = -EINVAL;
 843                         break;
 844                 }
 845
 846                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 847                              (u32 __user *) optval))
 848                         err = -EFAULT;
 849
 850                 break;
 851
 852         default:
 853                 err = -ENOPROTOOPT;
 854                 break;
 855         }
 856
 857         release_sock(sk);
 858         return err;
 859 }
 860
 861 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 862 {
 863         struct sock *sk __maybe_unused = sock->sk;
 864         int err;
 865
 866         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 867
 868         err = bt_sock_ioctl(sock, cmd, arg);
 869
 870         if (err == -ENOIOCTLCMD) {
 871 #ifdef CONFIG_BT_RFCOMM_TTY
 872                 lock_sock(sk);
 873                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 874                 release_sock(sk);
 875 #else
 876                 err = -EOPNOTSUPP;
 877 #endif
 878         }
 879
 880         return err;
 881 }
 882
 883 #ifdef CONFIG_COMPAT
 884 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 885 {
 886         return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
 887 }
 888 #endif
 889
 890 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 891 {
 892         struct sock *sk = sock->sk;
 893         int err = 0;
 894
 895         BT_DBG("sock %p, sk %p", sock, sk);
 896
 897         if (!sk)
 898                 return 0;
 899
 900         lock_sock(sk);
 901         if (!sk->sk_shutdown) {
 902                 sk->sk_shutdown = SHUTDOWN_MASK;
 903
 904                 release_sock(sk);
 905                 __rfcomm_sock_close(sk);
 906                 lock_sock(sk);
 907
 908                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
 909                     !(current->flags & PF_EXITING))
 910                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 911         }
 912         release_sock(sk);
 913         return err;
 914 }
 915
 916 static int rfcomm_sock_release(struct socket *sock)
 917 {
 918         struct sock *sk = sock->sk;
 919         int err;
 920
 921         BT_DBG("sock %p, sk %p", sock, sk);
 922
 923         if (!sk)
 924                 return 0;
 925
 926         err = rfcomm_sock_shutdown(sock, 2);
 927
 928         sock_orphan(sk);
 929         rfcomm_sock_kill(sk);
 930         return err;
 931 }
 932
 933 /* ---- RFCOMM core layer callbacks ----
 934  *
 935  * called under rfcomm_lock()
 936  */
 937 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 938 {
 939         struct sock *sk, *parent;
 940         bdaddr_t src, dst;
 941         int result = 0;
 942
 943         BT_DBG("session %p channel %d", s, channel);
 944
 945         rfcomm_session_getaddr(s, &src, &dst);
 946
 947         /* Check if we have socket listening on channel */
 948         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 949         if (!parent)
 950                 return 0;
 951
 952         lock_sock(parent);
 953
 954         /* Check for backlog size */
 955         if (sk_acceptq_is_full(parent)) {
 956                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 957                 goto done;
 958         }
 959
 960         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
 961         if (!sk)
 962                 goto done;
 963
 964         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 965
 966         rfcomm_sock_init(sk, parent);
 967         bacpy(&rfcomm_pi(sk)->src, &src);
 968         bacpy(&rfcomm_pi(sk)->dst, &dst);
 969         rfcomm_pi(sk)->channel = channel;
 970
 971         sk->sk_state = BT_CONFIG;
 972         bt_accept_enqueue(parent, sk, true);
 973
 974         /* Accept connection and return socket DLC */
 975         *d = rfcomm_pi(sk)->dlc;
 976         result = 1;
 977
 978 done:
 979         release_sock(parent);
 980
 981         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 982                 parent->sk_state_change(parent);
 983
 984         return result;
 985 }
 986
 987 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 988 {
 989         struct sock *sk;
 990
 991         read_lock(&rfcomm_sk_list.lock);
 992
 993         sk_for_each(sk, &rfcomm_sk_list.head) {
 994                 seq_printf(f, "%pMR %pMR %d %d\n",
 995                            &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
 996                            sk->sk_state, rfcomm_pi(sk)->channel);
 997         }
 998
 999         read_unlock(&rfcomm_sk_list.lock);
1000
1001         return 0;
1002 }
1003
1004 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1005
1006 static struct dentry *rfcomm_sock_debugfs;
1007
1008 static const struct proto_ops rfcomm_sock_ops = {
1009         .family         = PF_BLUETOOTH,
1010         .owner          = THIS_MODULE,
1011         .release        = rfcomm_sock_release,
1012         .bind           = rfcomm_sock_bind,
1013         .connect        = rfcomm_sock_connect,
1014         .listen         = rfcomm_sock_listen,
1015         .accept         = rfcomm_sock_accept,
1016         .getname        = rfcomm_sock_getname,
1017         .sendmsg        = rfcomm_sock_sendmsg,
1018         .recvmsg        = rfcomm_sock_recvmsg,
1019         .shutdown       = rfcomm_sock_shutdown,
1020         .setsockopt     = rfcomm_sock_setsockopt,
1021         .getsockopt     = rfcomm_sock_getsockopt,
1022         .ioctl          = rfcomm_sock_ioctl,
1023         .gettstamp      = sock_gettstamp,
1024         .poll           = bt_sock_poll,
1025         .socketpair     = sock_no_socketpair,
1026         .mmap           = sock_no_mmap,
1027 #ifdef CONFIG_COMPAT
1028         .compat_ioctl   = rfcomm_sock_compat_ioctl,
1029 #endif
1030 };
1031
1032 static const struct net_proto_family rfcomm_sock_family_ops = {
1033         .family         = PF_BLUETOOTH,
1034         .owner          = THIS_MODULE,
1035         .create         = rfcomm_sock_create
1036 };
1037
1038 int __init rfcomm_init_sockets(void)
1039 {
1040         int err;
1041
1042         BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1043
1044         err = proto_register(&rfcomm_proto, 0);
1045         if (err < 0)
1046                 return err;
1047
1048         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1049         if (err < 0) {
1050                 BT_ERR("RFCOMM socket layer registration failed");
1051                 goto error;
1052         }
1053
1054         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1055         if (err < 0) {
1056                 BT_ERR("Failed to create RFCOMM proc file");
1057                 bt_sock_unregister(BTPROTO_RFCOMM);
1058                 goto error;
1059         }
1060
1061         BT_INFO("RFCOMM socket layer initialized");
1062
1063         if (IS_ERR_OR_NULL(bt_debugfs))
1064                 return 0;
1065
1066         rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1067                                                   bt_debugfs, NULL,
1068                                                   &rfcomm_sock_debugfs_fops);
1069
1070         return 0;
1071
1072 error:
1073         proto_unregister(&rfcomm_proto);
1074         return err;
1075 }
1076
1077 void __exit rfcomm_cleanup_sockets(void)
1078 {
1079         bt_procfs_cleanup(&init_net, "rfcomm");
1080
1081         debugfs_remove(rfcomm_sock_debugfs);
1082
1083         bt_sock_unregister(BTPROTO_RFCOMM);
1084
1085         proto_unregister(&rfcomm_proto);
1086 }