1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2000-2001 Qualcomm Incorporated
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth SCO sockets. */
23
24 #include <linux/module.h>
25 #include <linux/debugfs.h>
26 #include <linux/seq_file.h>
27 #include <linux/sched/signal.h>
28 #include <linux/uio.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/sco.h>
33
34 static bool disable_esco;
35
36 static const struct proto_ops sco_sock_ops;
37
38 static struct bt_sock_list sco_sk_list = {
39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
40 };
41
42 /* ---- SCO connections ---- */
43 struct sco_conn {
44 struct hci_conn *hcon;
45
46 spinlock_t lock;
47 struct sock *sk;
48
49 struct delayed_work timeout_work;
50
51 unsigned int mtu;
52 struct kref ref;
53 };
54
55 #define sco_conn_lock(c) spin_lock(&c->lock)
56 #define sco_conn_unlock(c) spin_unlock(&c->lock)
57
58 static void sco_sock_close(struct sock *sk);
59 static void sco_sock_kill(struct sock *sk);
60
61 /* ----- SCO socket info ----- */
62 #define sco_pi(sk) ((struct sco_pinfo *) sk)
63
64 struct sco_pinfo {
65 struct bt_sock bt;
66 bdaddr_t src;
67 bdaddr_t dst;
68 __u32 flags;
69 __u16 setting;
70 struct bt_codec codec;
71 struct sco_conn *conn;
72 };
73
74 /* ---- SCO timers ---- */
75 #define SCO_CONN_TIMEOUT (HZ * 40)
76 #define SCO_DISCONN_TIMEOUT (HZ * 2)
77
sco_conn_free(struct kref * ref)78 static void sco_conn_free(struct kref *ref)
79 {
80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref);
81
82 BT_DBG("conn %p", conn);
83
84 if (conn->sk)
85 sco_pi(conn->sk)->conn = NULL;
86
87 if (conn->hcon) {
88 conn->hcon->sco_data = NULL;
89 hci_conn_drop(conn->hcon);
90 }
91
92 /* Ensure no more work items will run since hci_conn has been dropped */
93 disable_delayed_work_sync(&conn->timeout_work);
94
95 kfree(conn);
96 }
97
sco_conn_put(struct sco_conn * conn)98 static void sco_conn_put(struct sco_conn *conn)
99 {
100 if (!conn)
101 return;
102
103 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
104
105 kref_put(&conn->ref, sco_conn_free);
106 }
107
sco_conn_hold(struct sco_conn * conn)108 static struct sco_conn *sco_conn_hold(struct sco_conn *conn)
109 {
110 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
111
112 kref_get(&conn->ref);
113 return conn;
114 }
115
sco_conn_hold_unless_zero(struct sco_conn * conn)116 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn)
117 {
118 if (!conn)
119 return NULL;
120
121 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
122
123 if (!kref_get_unless_zero(&conn->ref))
124 return NULL;
125
126 return conn;
127 }
128
sco_sock_hold(struct sco_conn * conn)129 static struct sock *sco_sock_hold(struct sco_conn *conn)
130 {
131 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
132 return NULL;
133
134 sock_hold(conn->sk);
135
136 return conn->sk;
137 }
138
sco_sock_timeout(struct work_struct * work)139 static void sco_sock_timeout(struct work_struct *work)
140 {
141 struct sco_conn *conn = container_of(work, struct sco_conn,
142 timeout_work.work);
143 struct sock *sk;
144
145 conn = sco_conn_hold_unless_zero(conn);
146 if (!conn)
147 return;
148
149 sco_conn_lock(conn);
150 if (!conn->hcon) {
151 sco_conn_unlock(conn);
152 sco_conn_put(conn);
153 return;
154 }
155 sk = sco_sock_hold(conn);
156 sco_conn_unlock(conn);
157 sco_conn_put(conn);
158
159 if (!sk)
160 return;
161
162 BT_DBG("sock %p state %d", sk, sk->sk_state);
163
164 lock_sock(sk);
165 sk->sk_err = ETIMEDOUT;
166 sk->sk_state_change(sk);
167 release_sock(sk);
168 sock_put(sk);
169 }
170
sco_sock_set_timer(struct sock * sk,long timeout)171 static void sco_sock_set_timer(struct sock *sk, long timeout)
172 {
173 if (!sco_pi(sk)->conn)
174 return;
175
176 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
177 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
178 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
179 }
180
sco_sock_clear_timer(struct sock * sk)181 static void sco_sock_clear_timer(struct sock *sk)
182 {
183 if (!sco_pi(sk)->conn)
184 return;
185
186 BT_DBG("sock %p state %d", sk, sk->sk_state);
187 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
188 }
189
190 /* ---- SCO connections ---- */
191 /* Consumes a reference on @hcon, which the returned sco_conn owns until it is
192 * freed. On failure (NULL return) the reference is left for the caller to drop.
193 */
sco_conn_add(struct hci_conn * hcon)194 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
195 {
196 struct sco_conn *conn = hcon->sco_data;
197
198 conn = sco_conn_hold_unless_zero(conn);
199 if (conn) {
200 if (!conn->hcon) {
201 sco_conn_lock(conn);
202 conn->hcon = hcon;
203 sco_conn_unlock(conn);
204 } else {
205 /* conn already owns a reference on hcon */
206 hci_conn_drop(hcon);
207 }
208 return conn;
209 }
210
211 conn = kzalloc_obj(struct sco_conn);
212 if (!conn)
213 return NULL;
214
215 kref_init(&conn->ref);
216 spin_lock_init(&conn->lock);
217 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
218
219 hcon->sco_data = conn;
220 conn->hcon = hcon;
221 conn->mtu = hcon->mtu;
222
223 if (hcon->mtu > 0)
224 conn->mtu = hcon->mtu;
225 else
226 conn->mtu = 60;
227
228 BT_DBG("hcon %p conn %p", hcon, conn);
229
230 return conn;
231 }
232
233 /* Delete channel.
234 * Must be called on the locked socket. */
sco_chan_del(struct sock * sk,int err)235 static void sco_chan_del(struct sock *sk, int err)
236 {
237 struct sco_conn *conn;
238
239 conn = sco_pi(sk)->conn;
240 sco_pi(sk)->conn = NULL;
241
242 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
243
244 if (conn) {
245 sco_conn_lock(conn);
246 conn->sk = NULL;
247 sco_conn_unlock(conn);
248 sco_conn_put(conn);
249 }
250
251 sk->sk_state = BT_CLOSED;
252 sk->sk_err = err;
253 sk->sk_state_change(sk);
254
255 sock_set_flag(sk, SOCK_ZAPPED);
256 }
257
sco_conn_del(struct hci_conn * hcon,int err)258 static void sco_conn_del(struct hci_conn *hcon, int err)
259 {
260 struct sco_conn *conn = hcon->sco_data;
261 struct sock *sk;
262
263 conn = sco_conn_hold_unless_zero(conn);
264 if (!conn)
265 return;
266
267 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
268
269 sco_conn_lock(conn);
270 sk = sco_sock_hold(conn);
271 sco_conn_unlock(conn);
272 sco_conn_put(conn);
273
274 if (!sk)
275 return;
276
277 /* Kill socket */
278 lock_sock(sk);
279 sco_sock_clear_timer(sk);
280 sco_chan_del(sk, err);
281 release_sock(sk);
282 sock_put(sk);
283 }
284
__sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)285 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
286 struct sock *parent)
287 {
288 BT_DBG("conn %p", conn);
289
290 sco_pi(sk)->conn = sco_conn_hold(conn);
291 conn->sk = sk;
292
293 if (parent)
294 bt_accept_enqueue(parent, sk, true);
295 }
296
sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)297 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
298 struct sock *parent)
299 {
300 int err = 0;
301
302 sco_conn_lock(conn);
303 if (conn->sk || sco_pi(sk)->conn)
304 err = -EBUSY;
305 else
306 __sco_chan_add(conn, sk, parent);
307
308 sco_conn_unlock(conn);
309 return err;
310 }
311
sco_connect(struct sock * sk)312 static int sco_connect(struct sock *sk)
313 {
314 struct sco_conn *conn;
315 struct hci_conn *hcon;
316 struct hci_dev *hdev;
317 bdaddr_t src, dst;
318 struct bt_codec codec;
319 __u16 setting;
320 int err, type;
321
322 lock_sock(sk);
323 bacpy(&src, &sco_pi(sk)->src);
324 bacpy(&dst, &sco_pi(sk)->dst);
325 setting = sco_pi(sk)->setting;
326 codec = sco_pi(sk)->codec;
327 release_sock(sk);
328
329 BT_DBG("%pMR -> %pMR", &src, &dst);
330
331 hdev = hci_get_route(&dst, &src, BDADDR_BREDR);
332 if (!hdev)
333 return -EHOSTUNREACH;
334
335 hci_dev_lock(hdev);
336
337 if (lmp_esco_capable(hdev) && !disable_esco)
338 type = ESCO_LINK;
339 else
340 type = SCO_LINK;
341
342 switch (setting & SCO_AIRMODE_MASK) {
343 case SCO_AIRMODE_TRANSP:
344 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) {
345 err = -EOPNOTSUPP;
346 goto unlock;
347 }
348 break;
349 }
350
351 hcon = hci_connect_sco(hdev, type, &dst,
352 setting, &codec,
353 READ_ONCE(sk->sk_sndtimeo));
354 if (IS_ERR(hcon)) {
355 err = PTR_ERR(hcon);
356 goto unlock;
357 }
358
359 conn = sco_conn_add(hcon);
360 if (!conn) {
361 hci_conn_drop(hcon);
362 err = -ENOMEM;
363 goto unlock;
364 }
365
366 lock_sock(sk);
367
368 /* Recheck state after reacquiring the socket lock, as another
369 * thread may have changed it (e.g., closed the socket).
370 */
371 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
372 release_sock(sk);
373 sco_conn_put(conn);
374 err = -EBADFD;
375 goto unlock;
376 }
377
378 err = sco_chan_add(conn, sk, NULL);
379 sco_conn_put(conn);
380 if (err) {
381 release_sock(sk);
382 goto unlock;
383 }
384
385 /* Update source addr of the socket */
386 bacpy(&sco_pi(sk)->src, &hcon->src);
387
388 if (hcon->state == BT_CONNECTED) {
389 sco_sock_clear_timer(sk);
390 sk->sk_state = BT_CONNECTED;
391 } else {
392 sk->sk_state = BT_CONNECT;
393 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
394 }
395
396 release_sock(sk);
397
398 unlock:
399 hci_dev_unlock(hdev);
400 hci_dev_put(hdev);
401 return err;
402 }
403
sco_send_frame(struct sock * sk,struct sk_buff * skb,const struct sockcm_cookie * sockc)404 static int sco_send_frame(struct sock *sk, struct sk_buff *skb,
405 const struct sockcm_cookie *sockc)
406 {
407 struct sco_conn *conn = sco_pi(sk)->conn;
408 int len = skb->len;
409
410 /* Check outgoing MTU */
411 if (len > conn->mtu)
412 return -EINVAL;
413
414 BT_DBG("sk %p len %d", sk, len);
415
416 hci_setup_tx_timestamp(skb, 1, sockc);
417 hci_send_sco(conn->hcon, skb);
418
419 return len;
420 }
421
sco_recv_frame(struct sco_conn * conn,struct sk_buff * skb)422 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
423 {
424 struct sock *sk;
425
426 sco_conn_lock(conn);
427 sk = sco_sock_hold(conn);
428 sco_conn_unlock(conn);
429
430 if (!sk)
431 goto drop;
432
433 BT_DBG("sk %p len %u", sk, skb->len);
434
435 if (sk->sk_state != BT_CONNECTED)
436 goto drop_put;
437
438 if (!sock_queue_rcv_skb(sk, skb)) {
439 sock_put(sk);
440 return;
441 }
442
443 drop_put:
444 sock_put(sk);
445 drop:
446 kfree_skb(skb);
447 }
448
449 /* -------- Socket interface ---------- */
__sco_get_sock_listen_by_addr(bdaddr_t * ba)450 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
451 {
452 struct sock *sk;
453
454 sk_for_each(sk, &sco_sk_list.head) {
455 if (sk->sk_state != BT_LISTEN)
456 continue;
457
458 if (!bacmp(&sco_pi(sk)->src, ba))
459 return sk;
460 }
461
462 return NULL;
463 }
464
465 /* Find socket listening on source bdaddr.
466 * Returns closest match.
467 */
sco_get_sock_listen(bdaddr_t * src)468 static struct sock *sco_get_sock_listen(bdaddr_t *src)
469 {
470 struct sock *sk = NULL, *sk1 = NULL;
471
472 read_lock(&sco_sk_list.lock);
473
474 sk_for_each(sk, &sco_sk_list.head) {
475 if (sk->sk_state != BT_LISTEN)
476 continue;
477
478 /* Exact match. */
479 if (!bacmp(&sco_pi(sk)->src, src))
480 break;
481
482 /* Closest match */
483 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
484 sk1 = sk;
485 }
486
487 sk = sk ? sk : sk1;
488 if (sk)
489 sock_hold(sk);
490
491 read_unlock(&sco_sk_list.lock);
492
493 return sk;
494 }
495
sco_sock_destruct(struct sock * sk)496 static void sco_sock_destruct(struct sock *sk)
497 {
498 BT_DBG("sk %p", sk);
499
500 sco_conn_put(sco_pi(sk)->conn);
501
502 skb_queue_purge(&sk->sk_receive_queue);
503 skb_queue_purge(&sk->sk_write_queue);
504 skb_queue_purge(&sk->sk_error_queue);
505 }
506
sco_sock_cleanup_listen(struct sock * parent)507 static void sco_sock_cleanup_listen(struct sock *parent)
508 {
509 struct sock *sk;
510
511 BT_DBG("parent %p", parent);
512
513 /* Close not yet accepted channels */
514 while ((sk = bt_accept_dequeue(parent, NULL))) {
515 sco_sock_close(sk);
516 sco_sock_kill(sk);
517 /* Drop the reference handed back by bt_accept_dequeue(). */
518 sock_put(sk);
519 }
520
521 parent->sk_state = BT_CLOSED;
522 sock_set_flag(parent, SOCK_ZAPPED);
523 }
524
525 /* Kill socket (only if zapped and orphan)
526 * Must be called on unlocked socket.
527 */
sco_sock_kill(struct sock * sk)528 static void sco_sock_kill(struct sock *sk)
529 {
530 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
531 return;
532
533 BT_DBG("sk %p state %d", sk, sk->sk_state);
534
535 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
536 lock_sock(sk);
537 if (sco_pi(sk)->conn) {
538 sco_conn_lock(sco_pi(sk)->conn);
539 sco_pi(sk)->conn->sk = NULL;
540 sco_conn_unlock(sco_pi(sk)->conn);
541 }
542 release_sock(sk);
543
544 /* Kill poor orphan */
545 bt_sock_unlink(&sco_sk_list, sk);
546 sock_set_flag(sk, SOCK_DEAD);
547 sock_put(sk);
548 }
549
__sco_sock_close(struct sock * sk)550 static void __sco_sock_close(struct sock *sk)
551 {
552 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
553
554 switch (sk->sk_state) {
555 case BT_LISTEN:
556 sco_sock_cleanup_listen(sk);
557 break;
558
559 case BT_CONNECTED:
560 case BT_CONFIG:
561 case BT_CONNECT2:
562 case BT_CONNECT:
563 case BT_DISCONN:
564 sco_chan_del(sk, ECONNRESET);
565 break;
566
567 default:
568 sock_set_flag(sk, SOCK_ZAPPED);
569 break;
570 }
571
572 }
573
574 /* Must be called on unlocked socket. */
sco_sock_close(struct sock * sk)575 static void sco_sock_close(struct sock *sk)
576 {
577 struct sco_conn *conn;
578
579 lock_sock(sk);
580 conn = sco_pi(sk)->conn;
581 if (conn)
582 sco_conn_hold(conn);
583 release_sock(sk);
584
585 if (conn)
586 disable_delayed_work_sync(&conn->timeout_work);
587
588 lock_sock(sk);
589 __sco_sock_close(sk);
590 release_sock(sk);
591
592 if (conn)
593 sco_conn_put(conn);
594 }
595
sco_sock_init(struct sock * sk,struct sock * parent)596 static void sco_sock_init(struct sock *sk, struct sock *parent)
597 {
598 BT_DBG("sk %p", sk);
599
600 if (parent) {
601 sk->sk_type = parent->sk_type;
602 bt_sk(sk)->flags = bt_sk(parent)->flags;
603 security_sk_clone(parent, sk);
604 }
605 }
606
607 static struct proto sco_proto = {
608 .name = "SCO",
609 .owner = THIS_MODULE,
610 .obj_size = sizeof(struct sco_pinfo)
611 };
612
sco_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)613 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
614 int proto, gfp_t prio, int kern)
615 {
616 struct sock *sk;
617
618 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
619 if (!sk)
620 return NULL;
621
622 sk->sk_destruct = sco_sock_destruct;
623 sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
624
625 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
626 sco_pi(sk)->codec.id = BT_CODEC_CVSD;
627 sco_pi(sk)->codec.cid = 0xffff;
628 sco_pi(sk)->codec.vid = 0xffff;
629 sco_pi(sk)->codec.data_path = 0x00;
630
631 bt_sock_link(&sco_sk_list, sk);
632 return sk;
633 }
634
sco_sock_create(struct net * net,struct socket * sock,int protocol,int kern)635 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
636 int kern)
637 {
638 struct sock *sk;
639
640 BT_DBG("sock %p", sock);
641
642 sock->state = SS_UNCONNECTED;
643
644 if (sock->type != SOCK_SEQPACKET)
645 return -ESOCKTNOSUPPORT;
646
647 sock->ops = &sco_sock_ops;
648
649 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
650 if (!sk)
651 return -ENOMEM;
652
653 sco_sock_init(sk, NULL);
654 return 0;
655 }
656
sco_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int addr_len)657 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
658 int addr_len)
659 {
660 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
661 struct sock *sk = sock->sk;
662 int err = 0;
663
664 if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
665 addr->sa_family != AF_BLUETOOTH)
666 return -EINVAL;
667
668 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
669
670 lock_sock(sk);
671
672 if (sk->sk_state != BT_OPEN) {
673 err = -EBADFD;
674 goto done;
675 }
676
677 if (sk->sk_type != SOCK_SEQPACKET) {
678 err = -EINVAL;
679 goto done;
680 }
681
682 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
683
684 sk->sk_state = BT_BOUND;
685
686 done:
687 release_sock(sk);
688 return err;
689 }
690
sco_sock_connect(struct socket * sock,struct sockaddr_unsized * addr,int alen,int flags)691 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags)
692 {
693 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
694 struct sock *sk = sock->sk;
695 int err;
696
697 BT_DBG("sk %p", sk);
698
699 if (alen < sizeof(struct sockaddr_sco) ||
700 addr->sa_family != AF_BLUETOOTH)
701 return -EINVAL;
702
703 lock_sock(sk);
704
705 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
706 release_sock(sk);
707 return -EBADFD;
708 }
709
710 if (sk->sk_type != SOCK_SEQPACKET) {
711 release_sock(sk);
712 return -EINVAL;
713 }
714
715 /* Set destination address and psm */
716 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
717 release_sock(sk);
718
719 err = sco_connect(sk);
720 if (err)
721 return err;
722
723 lock_sock(sk);
724
725 err = bt_sock_wait_state(sk, BT_CONNECTED,
726 sock_sndtimeo(sk, flags & O_NONBLOCK));
727
728 release_sock(sk);
729 return err;
730 }
731
sco_sock_listen(struct socket * sock,int backlog)732 static int sco_sock_listen(struct socket *sock, int backlog)
733 {
734 struct sock *sk = sock->sk;
735 bdaddr_t *src = &sco_pi(sk)->src;
736 int err = 0;
737
738 BT_DBG("sk %p backlog %d", sk, backlog);
739
740 lock_sock(sk);
741
742 if (sk->sk_state != BT_BOUND) {
743 err = -EBADFD;
744 goto done;
745 }
746
747 if (sk->sk_type != SOCK_SEQPACKET) {
748 err = -EINVAL;
749 goto done;
750 }
751
752 write_lock(&sco_sk_list.lock);
753
754 if (__sco_get_sock_listen_by_addr(src)) {
755 err = -EADDRINUSE;
756 goto unlock;
757 }
758
759 sk->sk_max_ack_backlog = backlog;
760 sk->sk_ack_backlog = 0;
761
762 sk->sk_state = BT_LISTEN;
763
764 unlock:
765 write_unlock(&sco_sk_list.lock);
766
767 done:
768 release_sock(sk);
769 return err;
770 }
771
sco_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)772 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
773 struct proto_accept_arg *arg)
774 {
775 DEFINE_WAIT_FUNC(wait, woken_wake_function);
776 struct sock *sk = sock->sk, *ch;
777 long timeo;
778 int err = 0;
779
780 lock_sock(sk);
781
782 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
783
784 BT_DBG("sk %p timeo %ld", sk, timeo);
785
786 /* Wait for an incoming connection. (wake-one). */
787 add_wait_queue_exclusive(sk_sleep(sk), &wait);
788 while (1) {
789 if (sk->sk_state != BT_LISTEN) {
790 err = -EBADFD;
791 break;
792 }
793
794 ch = bt_accept_dequeue(sk, newsock);
795 if (ch) {
796 /* Drop the bridging ref from bt_accept_dequeue();
797 * the grafted socket keeps ch alive from here.
798 */
799 sock_put(ch);
800 break;
801 }
802
803 if (!timeo) {
804 err = -EAGAIN;
805 break;
806 }
807
808 if (signal_pending(current)) {
809 err = sock_intr_errno(timeo);
810 break;
811 }
812
813 release_sock(sk);
814
815 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
816 lock_sock(sk);
817 }
818 remove_wait_queue(sk_sleep(sk), &wait);
819
820 if (err)
821 goto done;
822
823 newsock->state = SS_CONNECTED;
824
825 BT_DBG("new socket %p", ch);
826
827 done:
828 release_sock(sk);
829 return err;
830 }
831
sco_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)832 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
833 int peer)
834 {
835 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
836 struct sock *sk = sock->sk;
837
838 BT_DBG("sock %p, sk %p", sock, sk);
839
840 addr->sa_family = AF_BLUETOOTH;
841
842 if (peer)
843 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
844 else
845 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
846
847 return sizeof(struct sockaddr_sco);
848 }
849
sco_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)850 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
851 size_t len)
852 {
853 struct sock *sk = sock->sk;
854 struct sk_buff *skb;
855 struct sockcm_cookie sockc;
856 int err;
857
858 BT_DBG("sock %p, sk %p", sock, sk);
859
860 err = sock_error(sk);
861 if (err)
862 return err;
863
864 if (msg->msg_flags & MSG_OOB)
865 return -EOPNOTSUPP;
866
867 hci_sockcm_init(&sockc, sk);
868
869 if (msg->msg_controllen) {
870 err = sock_cmsg_send(sk, msg, &sockc);
871 if (err)
872 return err;
873 }
874
875 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
876 if (IS_ERR(skb))
877 return PTR_ERR(skb);
878
879 lock_sock(sk);
880
881 if (sk->sk_state == BT_CONNECTED)
882 err = sco_send_frame(sk, skb, &sockc);
883 else
884 err = -ENOTCONN;
885
886 release_sock(sk);
887
888 if (err < 0)
889 kfree_skb(skb);
890 return err;
891 }
892
sco_conn_defer_accept(struct hci_conn * conn,u16 setting)893 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
894 {
895 struct hci_dev *hdev = conn->hdev;
896
897 BT_DBG("conn %p", conn);
898
899 conn->state = BT_CONFIG;
900
901 if (!lmp_esco_capable(hdev)) {
902 struct hci_cp_accept_conn_req cp;
903
904 bacpy(&cp.bdaddr, &conn->dst);
905 cp.role = 0x00; /* Ignored */
906
907 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
908 } else {
909 struct hci_cp_accept_sync_conn_req cp;
910
911 bacpy(&cp.bdaddr, &conn->dst);
912 cp.pkt_type = cpu_to_le16(conn->pkt_type);
913
914 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
915 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
916 cp.content_format = cpu_to_le16(setting);
917
918 switch (setting & SCO_AIRMODE_MASK) {
919 case SCO_AIRMODE_TRANSP:
920 if (conn->pkt_type & ESCO_2EV3)
921 cp.max_latency = cpu_to_le16(0x0008);
922 else
923 cp.max_latency = cpu_to_le16(0x000D);
924 cp.retrans_effort = 0x02;
925 break;
926 case SCO_AIRMODE_CVSD:
927 cp.max_latency = cpu_to_le16(0xffff);
928 cp.retrans_effort = 0xff;
929 break;
930 default:
931 /* use CVSD settings as fallback */
932 cp.max_latency = cpu_to_le16(0xffff);
933 cp.retrans_effort = 0xff;
934 break;
935 }
936
937 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
938 sizeof(cp), &cp);
939 }
940 }
941
sco_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)942 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
943 size_t len, int flags)
944 {
945 struct sock *sk = sock->sk;
946 struct sco_pinfo *pi = sco_pi(sk);
947
948 if (unlikely(flags & MSG_ERRQUEUE))
949 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
950 BT_SCM_ERROR);
951
952 lock_sock(sk);
953
954 if (sk->sk_state == BT_CONNECT2 &&
955 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
956 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
957 sk->sk_state = BT_CONFIG;
958
959 release_sock(sk);
960 return 0;
961 }
962
963 release_sock(sk);
964
965 return bt_sock_recvmsg(sock, msg, len, flags);
966 }
967
sco_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)968 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
969 sockptr_t optval, unsigned int optlen)
970 {
971 struct sock *sk = sock->sk;
972 int err = 0;
973 struct bt_voice voice;
974 u32 opt;
975 struct bt_codecs *codecs;
976 struct hci_dev *hdev;
977 __u8 buffer[255];
978
979 BT_DBG("sk %p", sk);
980
981 lock_sock(sk);
982
983 switch (optname) {
984
985 case BT_DEFER_SETUP:
986 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
987 err = -EINVAL;
988 break;
989 }
990
991 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
992 if (err)
993 break;
994
995 if (opt)
996 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
997 else
998 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
999 break;
1000
1001 case BT_VOICE:
1002 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1003 sk->sk_state != BT_CONNECT2) {
1004 err = -EINVAL;
1005 break;
1006 }
1007
1008 voice.setting = sco_pi(sk)->setting;
1009
1010 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval,
1011 optlen);
1012 if (err)
1013 break;
1014
1015 sco_pi(sk)->setting = voice.setting;
1016 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
1017 BDADDR_BREDR);
1018 if (!hdev) {
1019 err = -EBADFD;
1020 break;
1021 }
1022
1023 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
1024 case SCO_AIRMODE_TRANSP:
1025 if (enhanced_sync_conn_capable(hdev))
1026 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
1027 break;
1028 }
1029
1030 hci_dev_put(hdev);
1031 break;
1032
1033 case BT_PKT_STATUS:
1034 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1035 if (err)
1036 break;
1037
1038 if (opt)
1039 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1040 else
1041 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1042 break;
1043
1044 case BT_CODEC:
1045 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1046 sk->sk_state != BT_CONNECT2) {
1047 err = -EINVAL;
1048 break;
1049 }
1050
1051 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
1052 BDADDR_BREDR);
1053 if (!hdev) {
1054 err = -EBADFD;
1055 break;
1056 }
1057
1058 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1059 hci_dev_put(hdev);
1060 err = -EOPNOTSUPP;
1061 break;
1062 }
1063
1064 if (!hdev->get_data_path_id) {
1065 hci_dev_put(hdev);
1066 err = -EOPNOTSUPP;
1067 break;
1068 }
1069
1070 if (optlen < sizeof(struct bt_codecs) ||
1071 optlen > sizeof(buffer)) {
1072 hci_dev_put(hdev);
1073 err = -EINVAL;
1074 break;
1075 }
1076
1077 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval,
1078 optlen);
1079 if (err) {
1080 hci_dev_put(hdev);
1081 break;
1082 }
1083
1084 codecs = (void *)buffer;
1085
1086 if (codecs->num_codecs != 1 ||
1087 optlen < struct_size(codecs, codecs, codecs->num_codecs)) {
1088 hci_dev_put(hdev);
1089 err = -EINVAL;
1090 break;
1091 }
1092
1093 sco_pi(sk)->codec = codecs->codecs[0];
1094 hci_dev_put(hdev);
1095 break;
1096
1097 default:
1098 err = -ENOPROTOOPT;
1099 break;
1100 }
1101
1102 release_sock(sk);
1103 return err;
1104 }
1105
sco_sock_getsockopt_old(struct socket * sock,int optname,sockopt_t * opt)1106 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
1107 sockopt_t *opt)
1108 {
1109 struct sock *sk = sock->sk;
1110 struct sco_options opts;
1111 struct sco_conninfo cinfo;
1112 int err = 0;
1113 size_t len;
1114
1115 BT_DBG("sk %p", sk);
1116
1117 len = opt->optlen;
1118
1119 lock_sock(sk);
1120
1121 switch (optname) {
1122 case SCO_OPTIONS:
1123 if (sk->sk_state != BT_CONNECTED &&
1124 !(sk->sk_state == BT_CONNECT2 &&
1125 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1126 err = -ENOTCONN;
1127 break;
1128 }
1129
1130 opts.mtu = sco_pi(sk)->conn->mtu;
1131
1132 BT_DBG("mtu %u", opts.mtu);
1133
1134 len = min(len, sizeof(opts));
1135 if (copy_to_iter(&opts, len, &opt->iter_out) != len)
1136 err = -EFAULT;
1137
1138 break;
1139
1140 case SCO_CONNINFO:
1141 if (sk->sk_state != BT_CONNECTED &&
1142 !(sk->sk_state == BT_CONNECT2 &&
1143 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1144 err = -ENOTCONN;
1145 break;
1146 }
1147
1148 memset(&cinfo, 0, sizeof(cinfo));
1149 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1150 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1151
1152 len = min(len, sizeof(cinfo));
1153 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len)
1154 err = -EFAULT;
1155
1156 break;
1157
1158 default:
1159 err = -ENOPROTOOPT;
1160 break;
1161 }
1162
1163 release_sock(sk);
1164 return err;
1165 }
1166
sco_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * opt)1167 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1168 sockopt_t *opt)
1169 {
1170 struct sock *sk = sock->sk;
1171 int len, val, err = 0;
1172 struct bt_voice voice;
1173 u32 phys;
1174 int buf_len;
1175 struct codec_list *c;
1176 u8 num_codecs, i;
1177 struct hci_dev *hdev;
1178 struct hci_codec_caps *caps;
1179 struct bt_codec codec;
1180
1181 BT_DBG("sk %p", sk);
1182
1183 if (level == SOL_SCO)
1184 return sco_sock_getsockopt_old(sock, optname, opt);
1185
1186 len = opt->optlen;
1187
1188 lock_sock(sk);
1189
1190 switch (optname) {
1191
1192 case BT_DEFER_SETUP:
1193 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1194 err = -EINVAL;
1195 break;
1196 }
1197
1198 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1199 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1200 sizeof(val))
1201 err = -EFAULT;
1202
1203 break;
1204
1205 case BT_VOICE:
1206 voice.setting = sco_pi(sk)->setting;
1207
1208 len = min_t(unsigned int, len, sizeof(voice));
1209 if (copy_to_iter(&voice, len, &opt->iter_out) != len)
1210 err = -EFAULT;
1211
1212 break;
1213
1214 case BT_PHY:
1215 if (sk->sk_state != BT_CONNECTED) {
1216 err = -ENOTCONN;
1217 break;
1218 }
1219
1220 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1221
1222 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) !=
1223 sizeof(phys))
1224 err = -EFAULT;
1225 break;
1226
1227 case BT_PKT_STATUS:
1228 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1229 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1230 sizeof(val))
1231 err = -EFAULT;
1232 break;
1233
1234 case BT_SNDMTU:
1235 case BT_RCVMTU:
1236 if (sk->sk_state != BT_CONNECTED) {
1237 err = -ENOTCONN;
1238 break;
1239 }
1240
1241 val = sco_pi(sk)->conn->mtu;
1242 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1243 sizeof(val))
1244 err = -EFAULT;
1245 break;
1246
1247 case BT_CODEC:
1248 num_codecs = 0;
1249 buf_len = 0;
1250
1251 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1252 if (!hdev) {
1253 err = -EBADFD;
1254 break;
1255 }
1256
1257 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1258 hci_dev_put(hdev);
1259 err = -EOPNOTSUPP;
1260 break;
1261 }
1262
1263 if (!hdev->get_data_path_id) {
1264 hci_dev_put(hdev);
1265 err = -EOPNOTSUPP;
1266 break;
1267 }
1268
1269 release_sock(sk);
1270
1271 /* find total buffer size required to copy codec + caps */
1272 hci_dev_lock(hdev);
1273 list_for_each_entry(c, &hdev->local_codecs, list) {
1274 if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1275 continue;
1276 num_codecs++;
1277 for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1278 buf_len += 1 + caps->len;
1279 caps = (void *)&caps->data[caps->len];
1280 }
1281 buf_len += sizeof(struct bt_codec);
1282 }
1283 hci_dev_unlock(hdev);
1284
1285 buf_len += sizeof(struct bt_codecs);
1286 if (buf_len > len) {
1287 hci_dev_put(hdev);
1288 return -ENOBUFS;
1289 }
1290
1291 if (copy_to_iter(&num_codecs, sizeof(num_codecs),
1292 &opt->iter_out) != sizeof(num_codecs)) {
1293 hci_dev_put(hdev);
1294 return -EFAULT;
1295 }
1296
1297 /* Iterate all the codecs supported over SCO and populate
1298 * codec data
1299 */
1300 hci_dev_lock(hdev);
1301 list_for_each_entry(c, &hdev->local_codecs, list) {
1302 if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1303 continue;
1304
1305 codec.id = c->id;
1306 codec.cid = c->cid;
1307 codec.vid = c->vid;
1308 err = hdev->get_data_path_id(hdev, &codec.data_path);
1309 if (err < 0)
1310 break;
1311 codec.num_caps = c->num_caps;
1312 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out)
1313 != sizeof(codec)) {
1314 err = -EFAULT;
1315 break;
1316 }
1317
1318 /* find codec capabilities data length */
1319 len = 0;
1320 for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1321 len += 1 + caps->len;
1322 caps = (void *)&caps->data[caps->len];
1323 }
1324
1325 /* copy codec capabilities data */
1326 if (len &&
1327 copy_to_iter(c->caps, len, &opt->iter_out) != len) {
1328 err = -EFAULT;
1329 break;
1330 }
1331 }
1332
1333 hci_dev_unlock(hdev);
1334 hci_dev_put(hdev);
1335
1336 lock_sock(sk);
1337
1338 if (!err)
1339 opt->optlen = buf_len;
1340
1341 break;
1342
1343 default:
1344 err = -ENOPROTOOPT;
1345 break;
1346 }
1347
1348 release_sock(sk);
1349 return err;
1350 }
1351
sco_sock_shutdown(struct socket * sock,int how)1352 static int sco_sock_shutdown(struct socket *sock, int how)
1353 {
1354 struct sock *sk = sock->sk;
1355 int err = 0;
1356
1357 BT_DBG("sock %p, sk %p", sock, sk);
1358
1359 if (!sk)
1360 return 0;
1361
1362 sock_hold(sk);
1363 lock_sock(sk);
1364
1365 if (!sk->sk_shutdown) {
1366 sk->sk_shutdown = SHUTDOWN_MASK;
1367 sco_sock_clear_timer(sk);
1368 __sco_sock_close(sk);
1369
1370 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1371 !(current->flags & PF_EXITING))
1372 err = bt_sock_wait_state(sk, BT_CLOSED,
1373 sk->sk_lingertime);
1374 }
1375
1376 release_sock(sk);
1377 sock_put(sk);
1378
1379 return err;
1380 }
1381
sco_sock_release(struct socket * sock)1382 static int sco_sock_release(struct socket *sock)
1383 {
1384 struct sock *sk = sock->sk;
1385 int err = 0;
1386
1387 BT_DBG("sock %p, sk %p", sock, sk);
1388
1389 if (!sk)
1390 return 0;
1391
1392 sco_sock_close(sk);
1393
1394 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1395 !(current->flags & PF_EXITING)) {
1396 lock_sock(sk);
1397 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1398 release_sock(sk);
1399 }
1400
1401 sock_orphan(sk);
1402 sco_sock_kill(sk);
1403 return err;
1404 }
1405
sco_conn_ready(struct sco_conn * conn)1406 static void sco_conn_ready(struct sco_conn *conn)
1407 {
1408 struct sock *parent, *sk;
1409
1410 sco_conn_lock(conn);
1411 sk = sco_sock_hold(conn);
1412 sco_conn_unlock(conn);
1413
1414 BT_DBG("conn %p", conn);
1415
1416 if (sk) {
1417 lock_sock(sk);
1418
1419 /* conn->sk may have become NULL if racing with sk close, but
1420 * due to held hdev->lock, it can't become different sk.
1421 */
1422 if (conn->sk) {
1423 sco_sock_clear_timer(sk);
1424 sk->sk_state = BT_CONNECTED;
1425 sk->sk_state_change(sk);
1426 }
1427
1428 release_sock(sk);
1429 sock_put(sk);
1430 } else {
1431 if (!conn->hcon)
1432 return;
1433
1434 lockdep_assert_held(&conn->hcon->hdev->lock);
1435
1436 parent = sco_get_sock_listen(&conn->hcon->src);
1437 if (!parent)
1438 return;
1439
1440 lock_sock(parent);
1441
1442 sco_conn_lock(conn);
1443
1444 /* hdev->lock guarantees conn->sk == NULL still here */
1445
1446 if (parent->sk_state != BT_LISTEN)
1447 goto release;
1448
1449 sk = sco_sock_alloc(sock_net(parent), NULL,
1450 BTPROTO_SCO, GFP_ATOMIC, 0);
1451 if (!sk)
1452 goto release;
1453
1454 sco_sock_init(sk, parent);
1455
1456 bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1457 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1458
1459 __sco_chan_add(conn, sk, parent);
1460
1461 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1462 sk->sk_state = BT_CONNECT2;
1463 else
1464 sk->sk_state = BT_CONNECTED;
1465
1466 /* Wake up parent */
1467 parent->sk_data_ready(parent);
1468
1469 release:
1470 sco_conn_unlock(conn);
1471 release_sock(parent);
1472 sock_put(parent);
1473 }
1474 }
1475
1476 /* ----- SCO interface with lower layer (HCI) ----- */
sco_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr,__u8 * flags)1477 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1478 {
1479 struct sock *sk;
1480 int lm = 0;
1481
1482 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1483
1484 /* Find listening sockets */
1485 read_lock(&sco_sk_list.lock);
1486 sk_for_each(sk, &sco_sk_list.head) {
1487 if (sk->sk_state != BT_LISTEN)
1488 continue;
1489
1490 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1491 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1492 lm |= HCI_LM_ACCEPT;
1493
1494 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1495 *flags |= HCI_PROTO_DEFER;
1496 break;
1497 }
1498 }
1499 read_unlock(&sco_sk_list.lock);
1500
1501 return lm;
1502 }
1503
sco_connect_cfm(struct hci_conn * hcon,__u8 status)1504 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1505 {
1506 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1507 return;
1508
1509 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1510
1511 if (!status) {
1512 struct sco_conn *conn;
1513
1514 conn = sco_conn_add(hci_conn_hold(hcon));
1515 if (conn) {
1516 sco_conn_ready(conn);
1517 sco_conn_put(conn);
1518 } else {
1519 hci_conn_drop(hcon);
1520 }
1521 } else
1522 sco_conn_del(hcon, bt_to_errno(status));
1523 }
1524
sco_disconn_cfm(struct hci_conn * hcon,__u8 reason)1525 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1526 {
1527 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1528 return;
1529
1530 BT_DBG("hcon %p reason %d", hcon, reason);
1531
1532 sco_conn_del(hcon, bt_to_errno(reason));
1533 }
1534
sco_recv_scodata(struct hci_dev * hdev,u16 handle,struct sk_buff * skb)1535 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb)
1536 {
1537 struct hci_conn *hcon;
1538 struct sco_conn *conn;
1539
1540 hci_dev_lock(hdev);
1541
1542 hcon = hci_conn_hash_lookup_handle(hdev, handle);
1543 if (!hcon) {
1544 hci_dev_unlock(hdev);
1545 kfree_skb(skb);
1546 return -ENOENT;
1547 }
1548
1549 conn = sco_conn_hold_unless_zero(hcon->sco_data);
1550 hcon = NULL;
1551
1552 hci_dev_unlock(hdev);
1553
1554 if (!conn) {
1555 kfree_skb(skb);
1556 return -EINVAL;
1557 }
1558
1559 BT_DBG("conn %p len %u", conn, skb->len);
1560
1561 if (skb->len)
1562 sco_recv_frame(conn, skb);
1563 else
1564 kfree_skb(skb);
1565
1566 sco_conn_put(conn);
1567 return 0;
1568 }
1569
1570 static struct hci_cb sco_cb = {
1571 .name = "SCO",
1572 .connect_cfm = sco_connect_cfm,
1573 .disconn_cfm = sco_disconn_cfm,
1574 };
1575
sco_debugfs_show(struct seq_file * f,void * p)1576 static int sco_debugfs_show(struct seq_file *f, void *p)
1577 {
1578 struct sock *sk;
1579
1580 read_lock(&sco_sk_list.lock);
1581
1582 sk_for_each(sk, &sco_sk_list.head) {
1583 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1584 &sco_pi(sk)->dst, sk->sk_state);
1585 }
1586
1587 read_unlock(&sco_sk_list.lock);
1588
1589 return 0;
1590 }
1591
1592 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1593
1594 static struct dentry *sco_debugfs;
1595
1596 static const struct proto_ops sco_sock_ops = {
1597 .family = PF_BLUETOOTH,
1598 .owner = THIS_MODULE,
1599 .release = sco_sock_release,
1600 .bind = sco_sock_bind,
1601 .connect = sco_sock_connect,
1602 .listen = sco_sock_listen,
1603 .accept = sco_sock_accept,
1604 .getname = sco_sock_getname,
1605 .sendmsg = sco_sock_sendmsg,
1606 .recvmsg = sco_sock_recvmsg,
1607 .poll = bt_sock_poll,
1608 .ioctl = bt_sock_ioctl,
1609 .gettstamp = sock_gettstamp,
1610 .mmap = sock_no_mmap,
1611 .socketpair = sock_no_socketpair,
1612 .shutdown = sco_sock_shutdown,
1613 .setsockopt = sco_sock_setsockopt,
1614 .getsockopt_iter = sco_sock_getsockopt
1615 };
1616
1617 static const struct net_proto_family sco_sock_family_ops = {
1618 .family = PF_BLUETOOTH,
1619 .owner = THIS_MODULE,
1620 .create = sco_sock_create,
1621 };
1622
sco_init(void)1623 int __init sco_init(void)
1624 {
1625 int err;
1626
1627 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1628
1629 err = proto_register(&sco_proto, 0);
1630 if (err < 0)
1631 return err;
1632
1633 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1634 if (err < 0) {
1635 BT_ERR("SCO socket registration failed");
1636 goto error;
1637 }
1638
1639 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1640 if (err < 0) {
1641 BT_ERR("Failed to create SCO proc file");
1642 bt_sock_unregister(BTPROTO_SCO);
1643 goto error;
1644 }
1645
1646 BT_INFO("SCO socket layer initialized");
1647
1648 hci_register_cb(&sco_cb);
1649
1650 if (IS_ERR_OR_NULL(bt_debugfs))
1651 return 0;
1652
1653 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1654 NULL, &sco_debugfs_fops);
1655
1656 return 0;
1657
1658 error:
1659 proto_unregister(&sco_proto);
1660 return err;
1661 }
1662
sco_exit(void)1663 void sco_exit(void)
1664 {
1665 bt_procfs_cleanup(&init_net, "sco");
1666
1667 debugfs_remove(sco_debugfs);
1668
1669 hci_unregister_cb(&sco_cb);
1670
1671 bt_sock_unregister(BTPROTO_SCO);
1672
1673 proto_unregister(&sco_proto);
1674 }
1675
1676 module_param(disable_esco, bool, 0644);
1677 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1678