1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI sockets. */ 23 #include <linux/compat.h> 24 #include <linux/export.h> 25 #include <linux/utsname.h> 26 #include <linux/sched.h> 27 #include <linux/uio.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_mon.h> 33 #include <net/bluetooth/mgmt.h> 34 35 #include "mgmt_util.h" 36 37 static LIST_HEAD(mgmt_chan_list); 38 static DEFINE_MUTEX(mgmt_chan_list_lock); 39 40 static DEFINE_IDA(sock_cookie_ida); 41 42 static atomic_t monitor_promisc = ATOMIC_INIT(0); 43 44 /* ----- HCI socket interface ----- */ 45 46 /* Socket info */ 47 #define hci_pi(sk) ((struct hci_pinfo *) sk) 48 49 struct hci_pinfo { 50 struct bt_sock bt; 51 struct hci_dev *hdev; 52 struct hci_filter filter; 53 __u8 cmsg_mask; 54 unsigned short channel; 55 unsigned long flags; 56 __u32 cookie; 57 char comm[TASK_COMM_LEN]; 58 __u16 mtu; 59 }; 60 61 static struct hci_dev *hci_hdev_from_sock(struct sock *sk) 62 { 63 struct hci_dev *hdev = hci_pi(sk)->hdev; 64 65 if (!hdev) 66 return ERR_PTR(-EBADFD); 67 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 68 return ERR_PTR(-EPIPE); 69 return hdev; 70 } 71 72 void hci_sock_set_flag(struct sock *sk, int nr) 73 { 74 set_bit(nr, &hci_pi(sk)->flags); 75 } 76 77 void hci_sock_clear_flag(struct sock *sk, int nr) 78 { 79 clear_bit(nr, &hci_pi(sk)->flags); 80 } 81 82 int hci_sock_test_flag(struct sock *sk, int nr) 83 { 84 return test_bit(nr, &hci_pi(sk)->flags); 85 } 86 87 unsigned short hci_sock_get_channel(struct sock *sk) 88 { 89 return hci_pi(sk)->channel; 90 } 91 92 u32 hci_sock_get_cookie(struct sock *sk) 93 { 94 return hci_pi(sk)->cookie; 95 } 96 97 static bool hci_sock_gen_cookie(struct sock *sk) 98 { 99 int id = hci_pi(sk)->cookie; 100 101 if (!id) { 102 id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL); 103 if (id < 0) 104 id = 0xffffffff; 105 106 hci_pi(sk)->cookie = id; 107 get_task_comm(hci_pi(sk)->comm, current); 108 return true; 109 } 110 111 return false; 112 } 113 114 static void hci_sock_free_cookie(struct sock *sk) 115 { 116 int id = hci_pi(sk)->cookie; 117 118 if (id) { 119 hci_pi(sk)->cookie = 0; 120 ida_free(&sock_cookie_ida, id); 121 } 122 } 123 124 static inline int hci_test_bit(int nr, const void *addr) 125 { 126 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 127 } 128 129 /* Security filter */ 130 #define HCI_SFLT_MAX_OGF 5 131 132 struct hci_sec_filter { 133 __u32 type_mask; 134 __u32 event_mask[2]; 135 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4]; 136 }; 137 138 static const struct hci_sec_filter hci_sec_filter = { 139 /* Packet types */ 140 0x10, 141 /* Events */ 142 { 0x1000d9fe, 0x0000b00c }, 143 /* Commands */ 144 { 145 { 0x0 }, 146 /* OGF_LINK_CTL */ 147 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 148 /* OGF_LINK_POLICY */ 149 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 150 /* OGF_HOST_CTL */ 151 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 152 /* OGF_INFO_PARAM */ 153 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 154 /* OGF_STATUS_PARAM */ 155 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 156 } 157 }; 158 159 static struct bt_sock_list hci_sk_list = { 160 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 161 }; 162 163 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) 164 { 165 struct hci_filter *flt; 166 int flt_type, flt_event; 167 u8 event; 168 169 /* Apply filter */ 170 flt = &hci_pi(sk)->filter; 171 172 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS; 173 174 if (!test_bit(flt_type, &flt->type_mask)) 175 return true; 176 177 /* Extra filter for event packets only */ 178 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) 179 return false; 180 181 if (skb->len < 1) 182 return true; 183 184 event = *(__u8 *)skb->data; 185 flt_event = event & HCI_FLT_EVENT_BITS; 186 187 if (!hci_test_bit(flt_event, &flt->event_mask)) 188 return true; 189 190 /* Check filter only when opcode is set */ 191 if (!flt->opcode) 192 return false; 193 194 if (event == HCI_EV_CMD_COMPLETE && skb->len < 5) 195 return true; 196 197 if (event == HCI_EV_CMD_COMPLETE && 198 flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) 199 return true; 200 201 if (event == HCI_EV_CMD_STATUS && skb->len < 6) 202 return true; 203 204 if (event == HCI_EV_CMD_STATUS && 205 flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) 206 return true; 207 208 return false; 209 } 210 211 /* Send frame to RAW socket */ 212 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 213 { 214 struct sock *sk; 215 struct sk_buff *skb_copy = NULL; 216 217 BT_DBG("hdev %p len %d", hdev, skb->len); 218 219 read_lock(&hci_sk_list.lock); 220 221 sk_for_each(sk, &hci_sk_list.head) { 222 struct sk_buff *nskb; 223 224 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 225 continue; 226 227 /* Don't send frame to the socket it came from */ 228 if (skb->sk == sk) 229 continue; 230 231 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { 232 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 233 hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 234 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 235 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 236 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) 237 continue; 238 if (is_filtered_packet(sk, skb)) 239 continue; 240 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 241 if (!bt_cb(skb)->incoming) 242 continue; 243 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 244 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 245 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 246 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 247 hci_skb_pkt_type(skb) != HCI_DRV_PKT) 248 continue; 249 } else { 250 /* Don't send frame to other channel types */ 251 continue; 252 } 253 254 if (!skb_copy) { 255 /* Create a private copy with headroom */ 256 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true); 257 if (!skb_copy) 258 continue; 259 260 /* Put type byte before the data */ 261 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1); 262 } 263 264 nskb = skb_clone(skb_copy, GFP_ATOMIC); 265 if (!nskb) 266 continue; 267 268 if (sock_queue_rcv_skb(sk, nskb)) 269 kfree_skb(nskb); 270 } 271 272 read_unlock(&hci_sk_list.lock); 273 274 kfree_skb(skb_copy); 275 } 276 277 static void hci_sock_copy_creds(struct sock *sk, struct sk_buff *skb) 278 { 279 struct scm_creds *creds; 280 281 if (!sk || WARN_ON(!skb)) 282 return; 283 284 creds = &bt_cb(skb)->creds; 285 286 /* Check if peer credentials is set */ 287 if (!sk->sk_peer_pid) { 288 /* Check if parent peer credentials is set */ 289 if (bt_sk(sk)->parent && bt_sk(sk)->parent->sk_peer_pid) 290 sk = bt_sk(sk)->parent; 291 else 292 return; 293 } 294 295 /* Check if scm_creds already set */ 296 if (creds->pid == pid_vnr(sk->sk_peer_pid)) 297 return; 298 299 memset(creds, 0, sizeof(*creds)); 300 301 creds->pid = pid_vnr(sk->sk_peer_pid); 302 if (sk->sk_peer_cred) { 303 creds->uid = sk->sk_peer_cred->uid; 304 creds->gid = sk->sk_peer_cred->gid; 305 } 306 } 307 308 static struct sk_buff *hci_skb_clone(struct sk_buff *skb) 309 { 310 struct sk_buff *nskb; 311 312 if (!skb) 313 return NULL; 314 315 nskb = skb_clone(skb, GFP_ATOMIC); 316 if (!nskb) 317 return NULL; 318 319 hci_sock_copy_creds(skb->sk, nskb); 320 321 return nskb; 322 } 323 324 /* Send frame to sockets with specific channel */ 325 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 326 int flag, struct sock *skip_sk) 327 { 328 struct sock *sk; 329 330 BT_DBG("channel %u len %d", channel, skb->len); 331 332 sk_for_each(sk, &hci_sk_list.head) { 333 struct sk_buff *nskb; 334 335 /* Ignore socket without the flag set */ 336 if (!hci_sock_test_flag(sk, flag)) 337 continue; 338 339 /* Skip the original socket */ 340 if (sk == skip_sk) 341 continue; 342 343 if (sk->sk_state != BT_BOUND) 344 continue; 345 346 if (hci_pi(sk)->channel != channel) 347 continue; 348 349 nskb = hci_skb_clone(skb); 350 if (!nskb) 351 continue; 352 353 if (sock_queue_rcv_skb(sk, nskb)) 354 kfree_skb(nskb); 355 } 356 357 } 358 359 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 360 int flag, struct sock *skip_sk) 361 { 362 read_lock(&hci_sk_list.lock); 363 __hci_send_to_channel(channel, skb, flag, skip_sk); 364 read_unlock(&hci_sk_list.lock); 365 } 366 367 /* Send frame to monitor socket */ 368 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb) 369 { 370 struct sk_buff *skb_copy = NULL; 371 struct hci_mon_hdr *hdr; 372 __le16 opcode; 373 374 if (!atomic_read(&monitor_promisc)) 375 return; 376 377 BT_DBG("hdev %p len %d", hdev, skb->len); 378 379 switch (hci_skb_pkt_type(skb)) { 380 case HCI_COMMAND_PKT: 381 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT); 382 break; 383 case HCI_EVENT_PKT: 384 opcode = cpu_to_le16(HCI_MON_EVENT_PKT); 385 break; 386 case HCI_ACLDATA_PKT: 387 if (bt_cb(skb)->incoming) 388 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT); 389 else 390 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT); 391 break; 392 case HCI_SCODATA_PKT: 393 if (bt_cb(skb)->incoming) 394 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT); 395 else 396 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT); 397 break; 398 case HCI_ISODATA_PKT: 399 if (bt_cb(skb)->incoming) 400 opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT); 401 else 402 opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT); 403 break; 404 case HCI_DRV_PKT: 405 if (bt_cb(skb)->incoming) 406 opcode = cpu_to_le16(HCI_MON_DRV_RX_PKT); 407 else 408 opcode = cpu_to_le16(HCI_MON_DRV_TX_PKT); 409 break; 410 case HCI_DIAG_PKT: 411 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG); 412 break; 413 default: 414 return; 415 } 416 417 /* Create a private copy with headroom */ 418 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true); 419 if (!skb_copy) 420 return; 421 422 hci_sock_copy_creds(skb->sk, skb_copy); 423 424 /* Put header before the data */ 425 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE); 426 hdr->opcode = opcode; 427 hdr->index = cpu_to_le16(hdev->id); 428 hdr->len = cpu_to_le16(skb->len); 429 430 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy, 431 HCI_SOCK_TRUSTED, NULL); 432 kfree_skb(skb_copy); 433 } 434 435 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 436 void *data, u16 data_len, ktime_t tstamp, 437 int flag, struct sock *skip_sk) 438 { 439 struct sock *sk; 440 __le16 index; 441 442 if (hdev) 443 index = cpu_to_le16(hdev->id); 444 else 445 index = cpu_to_le16(MGMT_INDEX_NONE); 446 447 read_lock(&hci_sk_list.lock); 448 449 sk_for_each(sk, &hci_sk_list.head) { 450 struct hci_mon_hdr *hdr; 451 struct sk_buff *skb; 452 453 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL) 454 continue; 455 456 /* Ignore socket without the flag set */ 457 if (!hci_sock_test_flag(sk, flag)) 458 continue; 459 460 /* Skip the original socket */ 461 if (sk == skip_sk) 462 continue; 463 464 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC); 465 if (!skb) 466 continue; 467 468 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 469 put_unaligned_le16(event, skb_put(skb, 2)); 470 471 if (data) 472 skb_put_data(skb, data, data_len); 473 474 skb->tstamp = tstamp; 475 476 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 477 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT); 478 hdr->index = index; 479 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 480 481 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 482 HCI_SOCK_TRUSTED, NULL); 483 kfree_skb(skb); 484 } 485 486 read_unlock(&hci_sk_list.lock); 487 } 488 489 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) 490 { 491 struct hci_mon_hdr *hdr; 492 struct hci_mon_new_index *ni; 493 struct hci_mon_index_info *ii; 494 struct sk_buff *skb; 495 __le16 opcode; 496 497 switch (event) { 498 case HCI_DEV_REG: 499 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC); 500 if (!skb) 501 return NULL; 502 503 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); 504 ni->type = 0x00; /* Old hdev->dev_type */ 505 ni->bus = hdev->bus; 506 bacpy(&ni->bdaddr, &hdev->bdaddr); 507 memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, 508 strnlen(hdev->name, sizeof(ni->name)), '\0'); 509 510 opcode = cpu_to_le16(HCI_MON_NEW_INDEX); 511 break; 512 513 case HCI_DEV_UNREG: 514 skb = bt_skb_alloc(0, GFP_ATOMIC); 515 if (!skb) 516 return NULL; 517 518 opcode = cpu_to_le16(HCI_MON_DEL_INDEX); 519 break; 520 521 case HCI_DEV_SETUP: 522 if (hdev->manufacturer == 0xffff) 523 return NULL; 524 fallthrough; 525 526 case HCI_DEV_UP: 527 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC); 528 if (!skb) 529 return NULL; 530 531 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE); 532 bacpy(&ii->bdaddr, &hdev->bdaddr); 533 ii->manufacturer = cpu_to_le16(hdev->manufacturer); 534 535 opcode = cpu_to_le16(HCI_MON_INDEX_INFO); 536 break; 537 538 case HCI_DEV_OPEN: 539 skb = bt_skb_alloc(0, GFP_ATOMIC); 540 if (!skb) 541 return NULL; 542 543 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX); 544 break; 545 546 case HCI_DEV_CLOSE: 547 skb = bt_skb_alloc(0, GFP_ATOMIC); 548 if (!skb) 549 return NULL; 550 551 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX); 552 break; 553 554 default: 555 return NULL; 556 } 557 558 __net_timestamp(skb); 559 560 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 561 hdr->opcode = opcode; 562 hdr->index = cpu_to_le16(hdev->id); 563 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 564 565 return skb; 566 } 567 568 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk) 569 { 570 struct hci_mon_hdr *hdr; 571 struct sk_buff *skb; 572 u16 format; 573 u8 ver[3]; 574 u32 flags; 575 576 /* No message needed when cookie is not present */ 577 if (!hci_pi(sk)->cookie) 578 return NULL; 579 580 switch (hci_pi(sk)->channel) { 581 case HCI_CHANNEL_RAW: 582 format = 0x0000; 583 ver[0] = BT_SUBSYS_VERSION; 584 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 585 break; 586 case HCI_CHANNEL_USER: 587 format = 0x0001; 588 ver[0] = BT_SUBSYS_VERSION; 589 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 590 break; 591 case HCI_CHANNEL_CONTROL: 592 format = 0x0002; 593 mgmt_fill_version_info(ver); 594 break; 595 default: 596 /* No message for unsupported format */ 597 return NULL; 598 } 599 600 skb = bt_skb_alloc(14 + TASK_COMM_LEN, GFP_ATOMIC); 601 if (!skb) 602 return NULL; 603 604 hci_sock_copy_creds(sk, skb); 605 606 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0; 607 608 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 609 put_unaligned_le16(format, skb_put(skb, 2)); 610 skb_put_data(skb, ver, sizeof(ver)); 611 put_unaligned_le32(flags, skb_put(skb, 4)); 612 skb_put_u8(skb, TASK_COMM_LEN); 613 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN); 614 615 __net_timestamp(skb); 616 617 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 618 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN); 619 if (hci_pi(sk)->hdev) 620 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 621 else 622 hdr->index = cpu_to_le16(HCI_DEV_NONE); 623 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 624 625 return skb; 626 } 627 628 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk) 629 { 630 struct hci_mon_hdr *hdr; 631 struct sk_buff *skb; 632 633 /* No message needed when cookie is not present */ 634 if (!hci_pi(sk)->cookie) 635 return NULL; 636 637 switch (hci_pi(sk)->channel) { 638 case HCI_CHANNEL_RAW: 639 case HCI_CHANNEL_USER: 640 case HCI_CHANNEL_CONTROL: 641 break; 642 default: 643 /* No message for unsupported format */ 644 return NULL; 645 } 646 647 skb = bt_skb_alloc(4, GFP_ATOMIC); 648 if (!skb) 649 return NULL; 650 651 hci_sock_copy_creds(sk, skb); 652 653 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 654 655 __net_timestamp(skb); 656 657 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 658 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE); 659 if (hci_pi(sk)->hdev) 660 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 661 else 662 hdr->index = cpu_to_le16(HCI_DEV_NONE); 663 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 664 665 return skb; 666 } 667 668 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index, 669 u16 opcode, u16 len, 670 const void *buf) 671 { 672 struct hci_mon_hdr *hdr; 673 struct sk_buff *skb; 674 675 skb = bt_skb_alloc(6 + len, GFP_ATOMIC); 676 if (!skb) 677 return NULL; 678 679 hci_sock_copy_creds(sk, skb); 680 681 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 682 put_unaligned_le16(opcode, skb_put(skb, 2)); 683 684 if (buf) 685 skb_put_data(skb, buf, len); 686 687 __net_timestamp(skb); 688 689 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 690 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND); 691 hdr->index = cpu_to_le16(index); 692 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 693 694 return skb; 695 } 696 697 static void __printf(2, 3) 698 send_monitor_note(struct sock *sk, const char *fmt, ...) 699 { 700 size_t len; 701 struct hci_mon_hdr *hdr; 702 struct sk_buff *skb; 703 va_list args; 704 705 va_start(args, fmt); 706 len = vsnprintf(NULL, 0, fmt, args); 707 va_end(args); 708 709 skb = bt_skb_alloc(len + 1, GFP_ATOMIC); 710 if (!skb) 711 return; 712 713 hci_sock_copy_creds(sk, skb); 714 715 va_start(args, fmt); 716 vsprintf(skb_put(skb, len), fmt, args); 717 *(u8 *)skb_put(skb, 1) = 0; 718 va_end(args); 719 720 __net_timestamp(skb); 721 722 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE); 723 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE); 724 hdr->index = cpu_to_le16(HCI_DEV_NONE); 725 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 726 727 if (sock_queue_rcv_skb(sk, skb)) 728 kfree_skb(skb); 729 } 730 731 static void send_monitor_replay(struct sock *sk) 732 { 733 struct hci_dev *hdev; 734 735 read_lock(&hci_dev_list_lock); 736 737 list_for_each_entry(hdev, &hci_dev_list, list) { 738 struct sk_buff *skb; 739 740 skb = create_monitor_event(hdev, HCI_DEV_REG); 741 if (!skb) 742 continue; 743 744 if (sock_queue_rcv_skb(sk, skb)) 745 kfree_skb(skb); 746 747 if (!test_bit(HCI_RUNNING, &hdev->flags)) 748 continue; 749 750 skb = create_monitor_event(hdev, HCI_DEV_OPEN); 751 if (!skb) 752 continue; 753 754 if (sock_queue_rcv_skb(sk, skb)) 755 kfree_skb(skb); 756 757 if (test_bit(HCI_UP, &hdev->flags)) 758 skb = create_monitor_event(hdev, HCI_DEV_UP); 759 else if (hci_dev_test_flag(hdev, HCI_SETUP)) 760 skb = create_monitor_event(hdev, HCI_DEV_SETUP); 761 else 762 skb = NULL; 763 764 if (skb) { 765 if (sock_queue_rcv_skb(sk, skb)) 766 kfree_skb(skb); 767 } 768 } 769 770 read_unlock(&hci_dev_list_lock); 771 } 772 773 static void send_monitor_control_replay(struct sock *mon_sk) 774 { 775 struct sock *sk; 776 777 read_lock(&hci_sk_list.lock); 778 779 sk_for_each(sk, &hci_sk_list.head) { 780 struct sk_buff *skb; 781 782 skb = create_monitor_ctrl_open(sk); 783 if (!skb) 784 continue; 785 786 if (sock_queue_rcv_skb(mon_sk, skb)) 787 kfree_skb(skb); 788 } 789 790 read_unlock(&hci_sk_list.lock); 791 } 792 793 /* Generate internal stack event */ 794 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data) 795 { 796 struct hci_event_hdr *hdr; 797 struct hci_ev_stack_internal *ev; 798 struct sk_buff *skb; 799 800 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC); 801 if (!skb) 802 return; 803 804 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE); 805 hdr->evt = HCI_EV_STACK_INTERNAL; 806 hdr->plen = sizeof(*ev) + dlen; 807 808 ev = skb_put(skb, sizeof(*ev) + dlen); 809 ev->type = type; 810 memcpy(ev->data, data, dlen); 811 812 bt_cb(skb)->incoming = 1; 813 __net_timestamp(skb); 814 815 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 816 hci_send_to_sock(hdev, skb); 817 kfree_skb(skb); 818 } 819 820 void hci_sock_dev_event(struct hci_dev *hdev, int event) 821 { 822 BT_DBG("hdev %s event %d", hdev->name, event); 823 824 if (atomic_read(&monitor_promisc)) { 825 struct sk_buff *skb; 826 827 /* Send event to monitor */ 828 skb = create_monitor_event(hdev, event); 829 if (skb) { 830 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 831 HCI_SOCK_TRUSTED, NULL); 832 kfree_skb(skb); 833 } 834 } 835 836 if (event <= HCI_DEV_DOWN) { 837 struct hci_ev_si_device ev; 838 839 /* Send event to sockets */ 840 ev.event = event; 841 ev.dev_id = hdev->id; 842 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 843 } 844 845 if (event == HCI_DEV_UNREG) { 846 struct sock *sk; 847 848 /* Wake up sockets using this dead device */ 849 read_lock(&hci_sk_list.lock); 850 sk_for_each(sk, &hci_sk_list.head) { 851 if (hci_pi(sk)->hdev == hdev) { 852 sk->sk_err = EPIPE; 853 sk->sk_state_change(sk); 854 } 855 } 856 read_unlock(&hci_sk_list.lock); 857 } 858 } 859 860 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel) 861 { 862 struct hci_mgmt_chan *c; 863 864 list_for_each_entry(c, &mgmt_chan_list, list) { 865 if (c->channel == channel) 866 return c; 867 } 868 869 return NULL; 870 } 871 872 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel) 873 { 874 struct hci_mgmt_chan *c; 875 876 mutex_lock(&mgmt_chan_list_lock); 877 c = __hci_mgmt_chan_find(channel); 878 mutex_unlock(&mgmt_chan_list_lock); 879 880 return c; 881 } 882 883 int hci_mgmt_chan_register(struct hci_mgmt_chan *c) 884 { 885 if (c->channel < HCI_CHANNEL_CONTROL) 886 return -EINVAL; 887 888 mutex_lock(&mgmt_chan_list_lock); 889 if (__hci_mgmt_chan_find(c->channel)) { 890 mutex_unlock(&mgmt_chan_list_lock); 891 return -EALREADY; 892 } 893 894 list_add_tail(&c->list, &mgmt_chan_list); 895 896 mutex_unlock(&mgmt_chan_list_lock); 897 898 return 0; 899 } 900 EXPORT_SYMBOL(hci_mgmt_chan_register); 901 902 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c) 903 { 904 mutex_lock(&mgmt_chan_list_lock); 905 list_del(&c->list); 906 mutex_unlock(&mgmt_chan_list_lock); 907 } 908 EXPORT_SYMBOL(hci_mgmt_chan_unregister); 909 910 static int hci_sock_release(struct socket *sock) 911 { 912 struct sock *sk = sock->sk; 913 struct hci_dev *hdev; 914 struct sk_buff *skb; 915 916 BT_DBG("sock %p sk %p", sock, sk); 917 918 if (!sk) 919 return 0; 920 921 lock_sock(sk); 922 923 switch (hci_pi(sk)->channel) { 924 case HCI_CHANNEL_MONITOR: 925 atomic_dec(&monitor_promisc); 926 break; 927 case HCI_CHANNEL_RAW: 928 case HCI_CHANNEL_USER: 929 case HCI_CHANNEL_CONTROL: 930 /* Send event to monitor */ 931 skb = create_monitor_ctrl_close(sk); 932 if (skb) { 933 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 934 HCI_SOCK_TRUSTED, NULL); 935 kfree_skb(skb); 936 } 937 938 hci_sock_free_cookie(sk); 939 break; 940 } 941 942 bt_sock_unlink(&hci_sk_list, sk); 943 944 hdev = hci_pi(sk)->hdev; 945 if (hdev) { 946 if (hci_pi(sk)->channel == HCI_CHANNEL_USER && 947 !hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 948 /* When releasing a user channel exclusive access, 949 * call hci_dev_do_close directly instead of calling 950 * hci_dev_close to ensure the exclusive access will 951 * be released and the controller brought back down. 952 * 953 * The checking of HCI_AUTO_OFF is not needed in this 954 * case since it will have been cleared already when 955 * opening the user channel. 956 * 957 * Make sure to also check that we haven't already 958 * unregistered since all the cleanup will have already 959 * been complete and hdev will get released when we put 960 * below. 961 */ 962 hci_dev_do_close(hdev); 963 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 964 mgmt_index_added(hdev); 965 } 966 967 atomic_dec(&hdev->promisc); 968 hci_dev_put(hdev); 969 } 970 971 sock_orphan(sk); 972 release_sock(sk); 973 sock_put(sk); 974 return 0; 975 } 976 977 static int hci_sock_reject_list_add(struct hci_dev *hdev, void __user *arg) 978 { 979 bdaddr_t bdaddr; 980 int err; 981 982 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 983 return -EFAULT; 984 985 hci_dev_lock(hdev); 986 987 err = hci_bdaddr_list_add(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 988 989 hci_dev_unlock(hdev); 990 991 return err; 992 } 993 994 static int hci_sock_reject_list_del(struct hci_dev *hdev, void __user *arg) 995 { 996 bdaddr_t bdaddr; 997 int err; 998 999 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 1000 return -EFAULT; 1001 1002 hci_dev_lock(hdev); 1003 1004 err = hci_bdaddr_list_del(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 1005 1006 hci_dev_unlock(hdev); 1007 1008 return err; 1009 } 1010 1011 /* Ioctls that require bound socket */ 1012 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, 1013 unsigned long arg) 1014 { 1015 struct hci_dev *hdev = hci_hdev_from_sock(sk); 1016 1017 if (IS_ERR(hdev)) 1018 return PTR_ERR(hdev); 1019 1020 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 1021 return -EBUSY; 1022 1023 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1024 return -EOPNOTSUPP; 1025 1026 switch (cmd) { 1027 case HCISETRAW: 1028 if (!capable(CAP_NET_ADMIN)) 1029 return -EPERM; 1030 return -EOPNOTSUPP; 1031 1032 case HCIGETCONNINFO: 1033 return hci_get_conn_info(hdev, (void __user *)arg); 1034 1035 case HCIGETAUTHINFO: 1036 return hci_get_auth_info(hdev, (void __user *)arg); 1037 1038 case HCIBLOCKADDR: 1039 if (!capable(CAP_NET_ADMIN)) 1040 return -EPERM; 1041 return hci_sock_reject_list_add(hdev, (void __user *)arg); 1042 1043 case HCIUNBLOCKADDR: 1044 if (!capable(CAP_NET_ADMIN)) 1045 return -EPERM; 1046 return hci_sock_reject_list_del(hdev, (void __user *)arg); 1047 } 1048 1049 return -ENOIOCTLCMD; 1050 } 1051 1052 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, 1053 unsigned long arg) 1054 { 1055 void __user *argp = (void __user *)arg; 1056 struct sock *sk = sock->sk; 1057 int err; 1058 1059 BT_DBG("cmd %x arg %lx", cmd, arg); 1060 1061 /* Make sure the cmd is valid before doing anything */ 1062 switch (cmd) { 1063 case HCIGETDEVLIST: 1064 case HCIGETDEVINFO: 1065 case HCIGETCONNLIST: 1066 case HCIDEVUP: 1067 case HCIDEVDOWN: 1068 case HCIDEVRESET: 1069 case HCIDEVRESTAT: 1070 case HCISETSCAN: 1071 case HCISETAUTH: 1072 case HCISETENCRYPT: 1073 case HCISETPTYPE: 1074 case HCISETLINKPOL: 1075 case HCISETLINKMODE: 1076 case HCISETACLMTU: 1077 case HCISETSCOMTU: 1078 case HCIINQUIRY: 1079 case HCISETRAW: 1080 case HCIGETCONNINFO: 1081 case HCIGETAUTHINFO: 1082 case HCIBLOCKADDR: 1083 case HCIUNBLOCKADDR: 1084 break; 1085 default: 1086 return -ENOIOCTLCMD; 1087 } 1088 1089 lock_sock(sk); 1090 1091 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1092 err = -EBADFD; 1093 goto done; 1094 } 1095 1096 /* When calling an ioctl on an unbound raw socket, then ensure 1097 * that the monitor gets informed. Ensure that the resulting event 1098 * is only send once by checking if the cookie exists or not. The 1099 * socket cookie will be only ever generated once for the lifetime 1100 * of a given socket. 1101 */ 1102 if (hci_sock_gen_cookie(sk)) { 1103 struct sk_buff *skb; 1104 1105 /* Perform careful checks before setting the HCI_SOCK_TRUSTED 1106 * flag. Make sure that not only the current task but also 1107 * the socket opener has the required capability, since 1108 * privileged programs can be tricked into making ioctl calls 1109 * on HCI sockets, and the socket should not be marked as 1110 * trusted simply because the ioctl caller is privileged. 1111 */ 1112 if (sk_capable(sk, CAP_NET_ADMIN)) 1113 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1114 1115 /* Send event to monitor */ 1116 skb = create_monitor_ctrl_open(sk); 1117 if (skb) { 1118 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1119 HCI_SOCK_TRUSTED, NULL); 1120 kfree_skb(skb); 1121 } 1122 } 1123 1124 release_sock(sk); 1125 1126 switch (cmd) { 1127 case HCIGETDEVLIST: 1128 return hci_get_dev_list(argp); 1129 1130 case HCIGETDEVINFO: 1131 return hci_get_dev_info(argp); 1132 1133 case HCIGETCONNLIST: 1134 return hci_get_conn_list(argp); 1135 1136 case HCIDEVUP: 1137 if (!capable(CAP_NET_ADMIN)) 1138 return -EPERM; 1139 return hci_dev_open(arg); 1140 1141 case HCIDEVDOWN: 1142 if (!capable(CAP_NET_ADMIN)) 1143 return -EPERM; 1144 return hci_dev_close(arg); 1145 1146 case HCIDEVRESET: 1147 if (!capable(CAP_NET_ADMIN)) 1148 return -EPERM; 1149 return hci_dev_reset(arg); 1150 1151 case HCIDEVRESTAT: 1152 if (!capable(CAP_NET_ADMIN)) 1153 return -EPERM; 1154 return hci_dev_reset_stat(arg); 1155 1156 case HCISETSCAN: 1157 case HCISETAUTH: 1158 case HCISETENCRYPT: 1159 case HCISETPTYPE: 1160 case HCISETLINKPOL: 1161 case HCISETLINKMODE: 1162 case HCISETACLMTU: 1163 case HCISETSCOMTU: 1164 if (!capable(CAP_NET_ADMIN)) 1165 return -EPERM; 1166 return hci_dev_cmd(cmd, argp); 1167 1168 case HCIINQUIRY: 1169 return hci_inquiry(argp); 1170 } 1171 1172 lock_sock(sk); 1173 1174 err = hci_sock_bound_ioctl(sk, cmd, arg); 1175 1176 done: 1177 release_sock(sk); 1178 return err; 1179 } 1180 1181 #ifdef CONFIG_COMPAT 1182 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd, 1183 unsigned long arg) 1184 { 1185 switch (cmd) { 1186 case HCIDEVUP: 1187 case HCIDEVDOWN: 1188 case HCIDEVRESET: 1189 case HCIDEVRESTAT: 1190 return hci_sock_ioctl(sock, cmd, arg); 1191 } 1192 1193 return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 1194 } 1195 #endif 1196 1197 static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 1198 int addr_len) 1199 { 1200 struct sockaddr_hci haddr; 1201 struct sock *sk = sock->sk; 1202 struct hci_dev *hdev = NULL; 1203 struct sk_buff *skb; 1204 int len, err = 0; 1205 1206 BT_DBG("sock %p sk %p", sock, sk); 1207 1208 if (!addr) 1209 return -EINVAL; 1210 1211 memset(&haddr, 0, sizeof(haddr)); 1212 len = min_t(unsigned int, sizeof(haddr), addr_len); 1213 memcpy(&haddr, addr, len); 1214 1215 if (haddr.hci_family != AF_BLUETOOTH) 1216 return -EINVAL; 1217 1218 lock_sock(sk); 1219 1220 /* Allow detaching from dead device and attaching to alive device, if 1221 * the caller wants to re-bind (instead of close) this socket in 1222 * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. 1223 */ 1224 hdev = hci_pi(sk)->hdev; 1225 if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 1226 write_lock(&hci_sk_list.lock); 1227 hci_pi(sk)->hdev = NULL; 1228 sk->sk_state = BT_OPEN; 1229 write_unlock(&hci_sk_list.lock); 1230 hci_dev_put(hdev); 1231 } 1232 hdev = NULL; 1233 1234 if (sk->sk_state == BT_BOUND) { 1235 err = -EALREADY; 1236 goto done; 1237 } 1238 1239 switch (haddr.hci_channel) { 1240 case HCI_CHANNEL_RAW: 1241 if (hci_pi(sk)->hdev) { 1242 err = -EALREADY; 1243 goto done; 1244 } 1245 1246 if (haddr.hci_dev != HCI_DEV_NONE) { 1247 hdev = hci_dev_get(haddr.hci_dev); 1248 if (!hdev) { 1249 err = -ENODEV; 1250 goto done; 1251 } 1252 1253 atomic_inc(&hdev->promisc); 1254 } 1255 1256 hci_pi(sk)->channel = haddr.hci_channel; 1257 1258 if (!hci_sock_gen_cookie(sk)) { 1259 /* In the case when a cookie has already been assigned, 1260 * then there has been already an ioctl issued against 1261 * an unbound socket and with that triggered an open 1262 * notification. Send a close notification first to 1263 * allow the state transition to bounded. 1264 */ 1265 skb = create_monitor_ctrl_close(sk); 1266 if (skb) { 1267 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1268 HCI_SOCK_TRUSTED, NULL); 1269 kfree_skb(skb); 1270 } 1271 } 1272 1273 if (capable(CAP_NET_ADMIN)) 1274 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1275 1276 hci_pi(sk)->hdev = hdev; 1277 1278 /* Send event to monitor */ 1279 skb = create_monitor_ctrl_open(sk); 1280 if (skb) { 1281 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1282 HCI_SOCK_TRUSTED, NULL); 1283 kfree_skb(skb); 1284 } 1285 break; 1286 1287 case HCI_CHANNEL_USER: 1288 if (hci_pi(sk)->hdev) { 1289 err = -EALREADY; 1290 goto done; 1291 } 1292 1293 if (haddr.hci_dev == HCI_DEV_NONE) { 1294 err = -EINVAL; 1295 goto done; 1296 } 1297 1298 if (!capable(CAP_NET_ADMIN)) { 1299 err = -EPERM; 1300 goto done; 1301 } 1302 1303 hdev = hci_dev_get(haddr.hci_dev); 1304 if (!hdev) { 1305 err = -ENODEV; 1306 goto done; 1307 } 1308 1309 if (test_bit(HCI_INIT, &hdev->flags) || 1310 hci_dev_test_flag(hdev, HCI_SETUP) || 1311 hci_dev_test_flag(hdev, HCI_CONFIG) || 1312 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && 1313 test_bit(HCI_UP, &hdev->flags))) { 1314 err = -EBUSY; 1315 hci_dev_put(hdev); 1316 goto done; 1317 } 1318 1319 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) { 1320 err = -EUSERS; 1321 hci_dev_put(hdev); 1322 goto done; 1323 } 1324 1325 hci_dev_lock(hdev); 1326 mgmt_index_removed(hdev); 1327 hci_dev_unlock(hdev); 1328 1329 err = hci_dev_open(hdev->id); 1330 if (err) { 1331 if (err == -EALREADY) { 1332 /* In case the transport is already up and 1333 * running, clear the error here. 1334 * 1335 * This can happen when opening a user 1336 * channel and HCI_AUTO_OFF grace period 1337 * is still active. 1338 */ 1339 err = 0; 1340 } else { 1341 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 1342 mgmt_index_added(hdev); 1343 hci_dev_put(hdev); 1344 goto done; 1345 } 1346 } 1347 1348 hci_pi(sk)->channel = haddr.hci_channel; 1349 1350 if (!hci_sock_gen_cookie(sk)) { 1351 /* In the case when a cookie has already been assigned, 1352 * this socket will transition from a raw socket into 1353 * a user channel socket. For a clean transition, send 1354 * the close notification first. 1355 */ 1356 skb = create_monitor_ctrl_close(sk); 1357 if (skb) { 1358 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1359 HCI_SOCK_TRUSTED, NULL); 1360 kfree_skb(skb); 1361 } 1362 } 1363 1364 /* The user channel is restricted to CAP_NET_ADMIN 1365 * capabilities and with that implicitly trusted. 1366 */ 1367 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1368 1369 hci_pi(sk)->hdev = hdev; 1370 1371 /* Send event to monitor */ 1372 skb = create_monitor_ctrl_open(sk); 1373 if (skb) { 1374 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1375 HCI_SOCK_TRUSTED, NULL); 1376 kfree_skb(skb); 1377 } 1378 1379 atomic_inc(&hdev->promisc); 1380 break; 1381 1382 case HCI_CHANNEL_MONITOR: 1383 if (haddr.hci_dev != HCI_DEV_NONE) { 1384 err = -EINVAL; 1385 goto done; 1386 } 1387 1388 if (!capable(CAP_NET_RAW)) { 1389 err = -EPERM; 1390 goto done; 1391 } 1392 1393 hci_pi(sk)->channel = haddr.hci_channel; 1394 1395 /* The monitor interface is restricted to CAP_NET_RAW 1396 * capabilities and with that implicitly trusted. 1397 */ 1398 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1399 1400 send_monitor_note(sk, "Linux version %s (%s)", 1401 init_utsname()->release, 1402 init_utsname()->machine); 1403 send_monitor_note(sk, "Bluetooth subsystem version %u.%u", 1404 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION); 1405 send_monitor_replay(sk); 1406 send_monitor_control_replay(sk); 1407 1408 atomic_inc(&monitor_promisc); 1409 break; 1410 1411 case HCI_CHANNEL_LOGGING: 1412 if (haddr.hci_dev != HCI_DEV_NONE) { 1413 err = -EINVAL; 1414 goto done; 1415 } 1416 1417 if (!capable(CAP_NET_ADMIN)) { 1418 err = -EPERM; 1419 goto done; 1420 } 1421 1422 hci_pi(sk)->channel = haddr.hci_channel; 1423 break; 1424 1425 default: 1426 if (!hci_mgmt_chan_find(haddr.hci_channel)) { 1427 err = -EINVAL; 1428 goto done; 1429 } 1430 1431 if (haddr.hci_dev != HCI_DEV_NONE) { 1432 err = -EINVAL; 1433 goto done; 1434 } 1435 1436 /* Users with CAP_NET_ADMIN capabilities are allowed 1437 * access to all management commands and events. For 1438 * untrusted users the interface is restricted and 1439 * also only untrusted events are sent. 1440 */ 1441 if (capable(CAP_NET_ADMIN)) 1442 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1443 1444 hci_pi(sk)->channel = haddr.hci_channel; 1445 1446 /* At the moment the index and unconfigured index events 1447 * are enabled unconditionally. Setting them on each 1448 * socket when binding keeps this functionality. They 1449 * however might be cleared later and then sending of these 1450 * events will be disabled, but that is then intentional. 1451 * 1452 * This also enables generic events that are safe to be 1453 * received by untrusted users. Example for such events 1454 * are changes to settings, class of device, name etc. 1455 */ 1456 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) { 1457 if (!hci_sock_gen_cookie(sk)) { 1458 /* In the case when a cookie has already been 1459 * assigned, this socket will transition from 1460 * a raw socket into a control socket. To 1461 * allow for a clean transition, send the 1462 * close notification first. 1463 */ 1464 skb = create_monitor_ctrl_close(sk); 1465 if (skb) { 1466 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1467 HCI_SOCK_TRUSTED, NULL); 1468 kfree_skb(skb); 1469 } 1470 } 1471 1472 /* Send event to monitor */ 1473 skb = create_monitor_ctrl_open(sk); 1474 if (skb) { 1475 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1476 HCI_SOCK_TRUSTED, NULL); 1477 kfree_skb(skb); 1478 } 1479 1480 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS); 1481 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 1482 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS); 1483 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS); 1484 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1485 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1486 } 1487 break; 1488 } 1489 1490 /* Default MTU to HCI_MAX_FRAME_SIZE if not set */ 1491 if (!hci_pi(sk)->mtu) 1492 hci_pi(sk)->mtu = HCI_MAX_FRAME_SIZE; 1493 1494 sk->sk_state = BT_BOUND; 1495 1496 done: 1497 release_sock(sk); 1498 return err; 1499 } 1500 1501 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, 1502 int peer) 1503 { 1504 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr; 1505 struct sock *sk = sock->sk; 1506 struct hci_dev *hdev; 1507 int err = 0; 1508 1509 BT_DBG("sock %p sk %p", sock, sk); 1510 1511 if (peer) 1512 return -EOPNOTSUPP; 1513 1514 lock_sock(sk); 1515 1516 hdev = hci_hdev_from_sock(sk); 1517 if (IS_ERR(hdev)) { 1518 err = PTR_ERR(hdev); 1519 goto done; 1520 } 1521 1522 haddr->hci_family = AF_BLUETOOTH; 1523 haddr->hci_dev = hdev->id; 1524 haddr->hci_channel= hci_pi(sk)->channel; 1525 err = sizeof(*haddr); 1526 1527 done: 1528 release_sock(sk); 1529 return err; 1530 } 1531 1532 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, 1533 struct sk_buff *skb) 1534 { 1535 __u8 mask = hci_pi(sk)->cmsg_mask; 1536 1537 if (mask & HCI_CMSG_DIR) { 1538 int incoming = bt_cb(skb)->incoming; 1539 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), 1540 &incoming); 1541 } 1542 1543 if (mask & HCI_CMSG_TSTAMP) { 1544 #ifdef CONFIG_COMPAT 1545 struct old_timeval32 ctv; 1546 #endif 1547 struct __kernel_old_timeval tv; 1548 void *data; 1549 int len; 1550 1551 skb_get_timestamp(skb, &tv); 1552 1553 data = &tv; 1554 len = sizeof(tv); 1555 #ifdef CONFIG_COMPAT 1556 if (!COMPAT_USE_64BIT_TIME && 1557 (msg->msg_flags & MSG_CMSG_COMPAT)) { 1558 ctv.tv_sec = tv.tv_sec; 1559 ctv.tv_usec = tv.tv_usec; 1560 data = &ctv; 1561 len = sizeof(ctv); 1562 } 1563 #endif 1564 1565 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 1566 } 1567 } 1568 1569 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1570 size_t len, int flags) 1571 { 1572 struct scm_cookie scm; 1573 struct sock *sk = sock->sk; 1574 struct sk_buff *skb; 1575 int copied, err; 1576 unsigned int skblen; 1577 1578 BT_DBG("sock %p, sk %p", sock, sk); 1579 1580 if (flags & MSG_OOB) 1581 return -EOPNOTSUPP; 1582 1583 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING) 1584 return -EOPNOTSUPP; 1585 1586 if (sk->sk_state == BT_CLOSED) 1587 return 0; 1588 1589 skb = skb_recv_datagram(sk, flags, &err); 1590 if (!skb) 1591 return err; 1592 1593 skblen = skb->len; 1594 copied = skb->len; 1595 if (len < copied) { 1596 msg->msg_flags |= MSG_TRUNC; 1597 copied = len; 1598 } 1599 1600 skb_reset_transport_header(skb); 1601 err = skb_copy_datagram_msg(skb, 0, msg, copied); 1602 1603 switch (hci_pi(sk)->channel) { 1604 case HCI_CHANNEL_RAW: 1605 hci_sock_cmsg(sk, msg, skb); 1606 break; 1607 case HCI_CHANNEL_USER: 1608 case HCI_CHANNEL_MONITOR: 1609 sock_recv_timestamp(msg, sk, skb); 1610 break; 1611 default: 1612 if (hci_mgmt_chan_find(hci_pi(sk)->channel)) 1613 sock_recv_timestamp(msg, sk, skb); 1614 break; 1615 } 1616 1617 memset(&scm, 0, sizeof(scm)); 1618 scm.creds = bt_cb(skb)->creds; 1619 1620 skb_free_datagram(sk, skb); 1621 1622 if (flags & MSG_TRUNC) 1623 copied = skblen; 1624 1625 scm_recv(sock, msg, &scm, flags); 1626 1627 return err ? : copied; 1628 } 1629 1630 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 1631 struct sk_buff *skb) 1632 { 1633 u8 *cp; 1634 struct mgmt_hdr *hdr; 1635 u16 opcode, index, len; 1636 struct hci_dev *hdev = NULL; 1637 const struct hci_mgmt_handler *handler; 1638 bool var_len, no_hdev; 1639 int err; 1640 1641 BT_DBG("got %d bytes", skb->len); 1642 1643 if (skb->len < sizeof(*hdr)) 1644 return -EINVAL; 1645 1646 hdr = (void *)skb->data; 1647 opcode = __le16_to_cpu(hdr->opcode); 1648 index = __le16_to_cpu(hdr->index); 1649 len = __le16_to_cpu(hdr->len); 1650 1651 if (len != skb->len - sizeof(*hdr)) { 1652 err = -EINVAL; 1653 goto done; 1654 } 1655 1656 if (chan->channel == HCI_CHANNEL_CONTROL) { 1657 struct sk_buff *cmd; 1658 1659 /* Send event to monitor */ 1660 cmd = create_monitor_ctrl_command(sk, index, opcode, len, 1661 skb->data + sizeof(*hdr)); 1662 if (cmd) { 1663 hci_send_to_channel(HCI_CHANNEL_MONITOR, cmd, 1664 HCI_SOCK_TRUSTED, NULL); 1665 kfree_skb(cmd); 1666 } 1667 } 1668 1669 if (opcode >= chan->handler_count || 1670 chan->handlers[opcode].func == NULL) { 1671 BT_DBG("Unknown op %u", opcode); 1672 err = mgmt_cmd_status(sk, index, opcode, 1673 MGMT_STATUS_UNKNOWN_COMMAND); 1674 goto done; 1675 } 1676 1677 handler = &chan->handlers[opcode]; 1678 1679 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) && 1680 !(handler->flags & HCI_MGMT_UNTRUSTED)) { 1681 err = mgmt_cmd_status(sk, index, opcode, 1682 MGMT_STATUS_PERMISSION_DENIED); 1683 goto done; 1684 } 1685 1686 if (index != MGMT_INDEX_NONE) { 1687 hdev = hci_dev_get(index); 1688 if (!hdev) { 1689 err = mgmt_cmd_status(sk, index, opcode, 1690 MGMT_STATUS_INVALID_INDEX); 1691 goto done; 1692 } 1693 1694 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1695 hci_dev_test_flag(hdev, HCI_CONFIG) || 1696 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1697 err = mgmt_cmd_status(sk, index, opcode, 1698 MGMT_STATUS_INVALID_INDEX); 1699 goto done; 1700 } 1701 1702 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1703 !(handler->flags & HCI_MGMT_UNCONFIGURED)) { 1704 err = mgmt_cmd_status(sk, index, opcode, 1705 MGMT_STATUS_INVALID_INDEX); 1706 goto done; 1707 } 1708 } 1709 1710 if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) { 1711 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV); 1712 if (no_hdev != !hdev) { 1713 err = mgmt_cmd_status(sk, index, opcode, 1714 MGMT_STATUS_INVALID_INDEX); 1715 goto done; 1716 } 1717 } 1718 1719 var_len = (handler->flags & HCI_MGMT_VAR_LEN); 1720 if ((var_len && len < handler->data_len) || 1721 (!var_len && len != handler->data_len)) { 1722 err = mgmt_cmd_status(sk, index, opcode, 1723 MGMT_STATUS_INVALID_PARAMS); 1724 goto done; 1725 } 1726 1727 if (hdev && chan->hdev_init) 1728 chan->hdev_init(sk, hdev); 1729 1730 cp = skb->data + sizeof(*hdr); 1731 1732 err = handler->func(sk, hdev, cp, len); 1733 if (err < 0) 1734 goto done; 1735 1736 err = skb->len; 1737 1738 done: 1739 if (hdev) 1740 hci_dev_put(hdev); 1741 1742 return err; 1743 } 1744 1745 static int hci_logging_frame(struct sock *sk, struct sk_buff *skb, 1746 unsigned int flags) 1747 { 1748 struct hci_mon_hdr *hdr; 1749 struct hci_dev *hdev; 1750 u16 index; 1751 int err; 1752 1753 /* The logging frame consists at minimum of the standard header, 1754 * the priority byte, the ident length byte and at least one string 1755 * terminator NUL byte. Anything shorter are invalid packets. 1756 */ 1757 if (skb->len < sizeof(*hdr) + 3) 1758 return -EINVAL; 1759 1760 hdr = (void *)skb->data; 1761 1762 if (__le16_to_cpu(hdr->len) != skb->len - sizeof(*hdr)) 1763 return -EINVAL; 1764 1765 if (__le16_to_cpu(hdr->opcode) == 0x0000) { 1766 __u8 priority = skb->data[sizeof(*hdr)]; 1767 __u8 ident_len = skb->data[sizeof(*hdr) + 1]; 1768 1769 /* Only the priorities 0-7 are valid and with that any other 1770 * value results in an invalid packet. 1771 * 1772 * The priority byte is followed by an ident length byte and 1773 * the NUL terminated ident string. Check that the ident 1774 * length is not overflowing the packet and also that the 1775 * ident string itself is NUL terminated. In case the ident 1776 * length is zero, the length value actually doubles as NUL 1777 * terminator identifier. 1778 * 1779 * The message follows the ident string (if present) and 1780 * must be NUL terminated. Otherwise it is not a valid packet. 1781 */ 1782 if (priority > 7 || skb->data[skb->len - 1] != 0x00 || 1783 ident_len > skb->len - sizeof(*hdr) - 3 || 1784 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) 1785 return -EINVAL; 1786 } else { 1787 return -EINVAL; 1788 } 1789 1790 index = __le16_to_cpu(hdr->index); 1791 1792 if (index != MGMT_INDEX_NONE) { 1793 hdev = hci_dev_get(index); 1794 if (!hdev) 1795 return -ENODEV; 1796 } else { 1797 hdev = NULL; 1798 } 1799 1800 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING); 1801 1802 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL); 1803 err = skb->len; 1804 1805 if (hdev) 1806 hci_dev_put(hdev); 1807 1808 return err; 1809 } 1810 1811 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1812 size_t len) 1813 { 1814 struct sock *sk = sock->sk; 1815 struct hci_mgmt_chan *chan; 1816 struct hci_dev *hdev; 1817 struct sk_buff *skb; 1818 int err; 1819 const unsigned int flags = msg->msg_flags; 1820 1821 BT_DBG("sock %p sk %p", sock, sk); 1822 1823 if (flags & MSG_OOB) 1824 return -EOPNOTSUPP; 1825 1826 if (flags & ~(MSG_DONTWAIT | MSG_NOSIGNAL | MSG_ERRQUEUE | MSG_CMSG_COMPAT)) 1827 return -EINVAL; 1828 1829 if (len < 4 || len > hci_pi(sk)->mtu) 1830 return -EINVAL; 1831 1832 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 1833 if (IS_ERR(skb)) 1834 return PTR_ERR(skb); 1835 1836 lock_sock(sk); 1837 1838 switch (hci_pi(sk)->channel) { 1839 case HCI_CHANNEL_RAW: 1840 case HCI_CHANNEL_USER: 1841 break; 1842 case HCI_CHANNEL_MONITOR: 1843 err = -EOPNOTSUPP; 1844 goto drop; 1845 case HCI_CHANNEL_LOGGING: 1846 err = hci_logging_frame(sk, skb, flags); 1847 goto drop; 1848 default: 1849 mutex_lock(&mgmt_chan_list_lock); 1850 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel); 1851 if (chan) 1852 err = hci_mgmt_cmd(chan, sk, skb); 1853 else 1854 err = -EINVAL; 1855 1856 mutex_unlock(&mgmt_chan_list_lock); 1857 goto drop; 1858 } 1859 1860 hdev = hci_hdev_from_sock(sk); 1861 if (IS_ERR(hdev)) { 1862 err = PTR_ERR(hdev); 1863 goto drop; 1864 } 1865 1866 if (!test_bit(HCI_UP, &hdev->flags)) { 1867 err = -ENETDOWN; 1868 goto drop; 1869 } 1870 1871 hci_skb_pkt_type(skb) = skb->data[0]; 1872 skb_pull(skb, 1); 1873 1874 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 1875 /* No permission check is needed for user channel 1876 * since that gets enforced when binding the socket. 1877 * 1878 * However check that the packet type is valid. 1879 */ 1880 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 1881 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1882 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1883 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 1884 hci_skb_pkt_type(skb) != HCI_DRV_PKT) { 1885 err = -EINVAL; 1886 goto drop; 1887 } 1888 1889 skb_queue_tail(&hdev->raw_q, skb); 1890 queue_work(hdev->workqueue, &hdev->tx_work); 1891 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) { 1892 u16 opcode = get_unaligned_le16(skb->data); 1893 u16 ogf = hci_opcode_ogf(opcode); 1894 u16 ocf = hci_opcode_ocf(opcode); 1895 1896 if (((ogf > HCI_SFLT_MAX_OGF) || 1897 (ocf > HCI_FLT_OCF_BITS) || 1898 !hci_test_bit(ocf, 1899 &hci_sec_filter.ocf_mask[ogf])) && 1900 !capable(CAP_NET_RAW)) { 1901 err = -EPERM; 1902 goto drop; 1903 } 1904 1905 /* Since the opcode has already been extracted here, store 1906 * a copy of the value for later use by the drivers. 1907 */ 1908 hci_skb_opcode(skb) = opcode; 1909 1910 if (ogf == 0x3f) { 1911 skb_queue_tail(&hdev->raw_q, skb); 1912 queue_work(hdev->workqueue, &hdev->tx_work); 1913 } else { 1914 /* Stand-alone HCI commands must be flagged as 1915 * single-command requests. 1916 */ 1917 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 1918 1919 skb_queue_tail(&hdev->cmd_q, skb); 1920 queue_work(hdev->workqueue, &hdev->cmd_work); 1921 } 1922 } else { 1923 if (!capable(CAP_NET_RAW)) { 1924 err = -EPERM; 1925 goto drop; 1926 } 1927 1928 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1929 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1930 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { 1931 err = -EINVAL; 1932 goto drop; 1933 } 1934 1935 skb_queue_tail(&hdev->raw_q, skb); 1936 queue_work(hdev->workqueue, &hdev->tx_work); 1937 } 1938 1939 err = len; 1940 1941 done: 1942 release_sock(sk); 1943 return err; 1944 1945 drop: 1946 kfree_skb(skb); 1947 goto done; 1948 } 1949 1950 static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 1951 sockptr_t optval, unsigned int optlen) 1952 { 1953 struct hci_ufilter uf = { .opcode = 0 }; 1954 struct sock *sk = sock->sk; 1955 int err = 0, opt = 0; 1956 1957 BT_DBG("sk %p, opt %d", sk, optname); 1958 1959 lock_sock(sk); 1960 1961 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1962 err = -EBADFD; 1963 goto done; 1964 } 1965 1966 switch (optname) { 1967 case HCI_DATA_DIR: 1968 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1969 if (err) 1970 break; 1971 1972 if (opt) 1973 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 1974 else 1975 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 1976 break; 1977 1978 case HCI_TIME_STAMP: 1979 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1980 if (err) 1981 break; 1982 1983 if (opt) 1984 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 1985 else 1986 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 1987 break; 1988 1989 case HCI_FILTER: 1990 { 1991 struct hci_filter *f = &hci_pi(sk)->filter; 1992 1993 uf.type_mask = f->type_mask; 1994 uf.opcode = f->opcode; 1995 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1996 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1997 } 1998 1999 err = copy_safe_from_sockptr(&uf, sizeof(uf), optval, optlen); 2000 if (err) 2001 break; 2002 2003 if (!capable(CAP_NET_RAW)) { 2004 uf.type_mask &= hci_sec_filter.type_mask; 2005 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 2006 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 2007 } 2008 2009 { 2010 struct hci_filter *f = &hci_pi(sk)->filter; 2011 2012 f->type_mask = uf.type_mask; 2013 f->opcode = uf.opcode; 2014 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 2015 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 2016 } 2017 break; 2018 2019 default: 2020 err = -ENOPROTOOPT; 2021 break; 2022 } 2023 2024 done: 2025 release_sock(sk); 2026 return err; 2027 } 2028 2029 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 2030 sockptr_t optval, unsigned int optlen) 2031 { 2032 struct sock *sk = sock->sk; 2033 int err = 0; 2034 u16 opt; 2035 2036 BT_DBG("sk %p, opt %d", sk, optname); 2037 2038 if (level == SOL_HCI) 2039 return hci_sock_setsockopt_old(sock, level, optname, optval, 2040 optlen); 2041 2042 if (level != SOL_BLUETOOTH) 2043 return -ENOPROTOOPT; 2044 2045 lock_sock(sk); 2046 2047 switch (optname) { 2048 case BT_SNDMTU: 2049 case BT_RCVMTU: 2050 switch (hci_pi(sk)->channel) { 2051 /* Don't allow changing MTU for channels that are meant for HCI 2052 * traffic only. 2053 */ 2054 case HCI_CHANNEL_RAW: 2055 case HCI_CHANNEL_USER: 2056 err = -ENOPROTOOPT; 2057 goto done; 2058 } 2059 2060 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 2061 if (err) 2062 break; 2063 2064 hci_pi(sk)->mtu = opt; 2065 break; 2066 2067 default: 2068 err = -ENOPROTOOPT; 2069 break; 2070 } 2071 2072 done: 2073 release_sock(sk); 2074 return err; 2075 } 2076 2077 static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname, 2078 sockopt_t *sopt) 2079 { 2080 struct hci_ufilter uf; 2081 struct sock *sk = sock->sk; 2082 int len, opt, err = 0; 2083 2084 BT_DBG("sk %p, opt %d", sk, optname); 2085 2086 len = sopt->optlen; 2087 2088 lock_sock(sk); 2089 2090 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 2091 err = -EBADFD; 2092 goto done; 2093 } 2094 2095 switch (optname) { 2096 case HCI_DATA_DIR: 2097 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 2098 opt = 1; 2099 else 2100 opt = 0; 2101 2102 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2103 sizeof(opt)) 2104 err = -EFAULT; 2105 break; 2106 2107 case HCI_TIME_STAMP: 2108 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 2109 opt = 1; 2110 else 2111 opt = 0; 2112 2113 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2114 sizeof(opt)) 2115 err = -EFAULT; 2116 break; 2117 2118 case HCI_FILTER: 2119 { 2120 struct hci_filter *f = &hci_pi(sk)->filter; 2121 2122 memset(&uf, 0, sizeof(uf)); 2123 uf.type_mask = f->type_mask; 2124 uf.opcode = f->opcode; 2125 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 2126 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 2127 } 2128 2129 len = min_t(unsigned int, len, sizeof(uf)); 2130 if (copy_to_iter(&uf, len, &sopt->iter_out) != len) 2131 err = -EFAULT; 2132 break; 2133 2134 default: 2135 err = -ENOPROTOOPT; 2136 break; 2137 } 2138 2139 done: 2140 release_sock(sk); 2141 return err; 2142 } 2143 2144 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, 2145 sockopt_t *sopt) 2146 { 2147 struct sock *sk = sock->sk; 2148 int err = 0; 2149 u16 mtu; 2150 2151 BT_DBG("sk %p, opt %d", sk, optname); 2152 2153 if (level == SOL_HCI) 2154 return hci_sock_getsockopt_old(sock, level, optname, sopt); 2155 2156 if (level != SOL_BLUETOOTH) 2157 return -ENOPROTOOPT; 2158 2159 lock_sock(sk); 2160 2161 switch (optname) { 2162 case BT_SNDMTU: 2163 case BT_RCVMTU: 2164 mtu = hci_pi(sk)->mtu; 2165 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 2166 sizeof(mtu)) 2167 err = -EFAULT; 2168 break; 2169 2170 default: 2171 err = -ENOPROTOOPT; 2172 break; 2173 } 2174 2175 release_sock(sk); 2176 return err; 2177 } 2178 2179 static void hci_sock_destruct(struct sock *sk) 2180 { 2181 mgmt_cleanup(sk); 2182 skb_queue_purge(&sk->sk_receive_queue); 2183 skb_queue_purge(&sk->sk_write_queue); 2184 skb_queue_purge(&sk->sk_error_queue); 2185 } 2186 2187 static const struct proto_ops hci_sock_ops = { 2188 .family = PF_BLUETOOTH, 2189 .owner = THIS_MODULE, 2190 .release = hci_sock_release, 2191 .bind = hci_sock_bind, 2192 .getname = hci_sock_getname, 2193 .sendmsg = hci_sock_sendmsg, 2194 .recvmsg = hci_sock_recvmsg, 2195 .ioctl = hci_sock_ioctl, 2196 #ifdef CONFIG_COMPAT 2197 .compat_ioctl = hci_sock_compat_ioctl, 2198 #endif 2199 .poll = datagram_poll, 2200 .listen = sock_no_listen, 2201 .shutdown = sock_no_shutdown, 2202 .setsockopt = hci_sock_setsockopt, 2203 .getsockopt_iter = hci_sock_getsockopt, 2204 .connect = sock_no_connect, 2205 .socketpair = sock_no_socketpair, 2206 .accept = sock_no_accept, 2207 .mmap = sock_no_mmap 2208 }; 2209 2210 static struct proto hci_sk_proto = { 2211 .name = "HCI", 2212 .owner = THIS_MODULE, 2213 .obj_size = sizeof(struct hci_pinfo) 2214 }; 2215 2216 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 2217 int kern) 2218 { 2219 struct sock *sk; 2220 2221 BT_DBG("sock %p", sock); 2222 2223 if (sock->type != SOCK_RAW) 2224 return -ESOCKTNOSUPPORT; 2225 2226 sock->ops = &hci_sock_ops; 2227 2228 sk = bt_sock_alloc(net, sock, &hci_sk_proto, protocol, GFP_ATOMIC, 2229 kern); 2230 if (!sk) 2231 return -ENOMEM; 2232 2233 sock->state = SS_UNCONNECTED; 2234 sk->sk_destruct = hci_sock_destruct; 2235 2236 bt_sock_link(&hci_sk_list, sk); 2237 return 0; 2238 } 2239 2240 static const struct net_proto_family hci_sock_family_ops = { 2241 .family = PF_BLUETOOTH, 2242 .owner = THIS_MODULE, 2243 .create = hci_sock_create, 2244 }; 2245 2246 int __init hci_sock_init(void) 2247 { 2248 int err; 2249 2250 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr)); 2251 2252 err = proto_register(&hci_sk_proto, 0); 2253 if (err < 0) 2254 return err; 2255 2256 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 2257 if (err < 0) { 2258 BT_ERR("HCI socket registration failed"); 2259 goto error; 2260 } 2261 2262 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL); 2263 if (err < 0) { 2264 BT_ERR("Failed to create HCI proc file"); 2265 bt_sock_unregister(BTPROTO_HCI); 2266 goto error; 2267 } 2268 2269 BT_INFO("HCI socket layer initialized"); 2270 2271 return 0; 2272 2273 error: 2274 proto_unregister(&hci_sk_proto); 2275 return err; 2276 } 2277 2278 void hci_sock_cleanup(void) 2279 { 2280 bt_procfs_cleanup(&init_net, "hci"); 2281 bt_sock_unregister(BTPROTO_HCI); 2282 proto_unregister(&hci_sk_proto); 2283 } 2284