1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI sockets. */ 23 #include <linux/compat.h> 24 #include <linux/export.h> 25 #include <linux/utsname.h> 26 #include <linux/sched.h> 27 #include <linux/uio.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_mon.h> 33 #include <net/bluetooth/mgmt.h> 34 35 #include "mgmt_util.h" 36 37 static LIST_HEAD(mgmt_chan_list); 38 static DEFINE_MUTEX(mgmt_chan_list_lock); 39 40 static DEFINE_IDA(sock_cookie_ida); 41 42 static atomic_t monitor_promisc = ATOMIC_INIT(0); 43 44 /* ----- HCI socket interface ----- */ 45 46 /* Socket info */ 47 #define hci_pi(sk) ((struct hci_pinfo *) sk) 48 49 struct hci_pinfo { 50 struct bt_sock bt; 51 struct hci_dev *hdev; 52 struct hci_filter filter; 53 __u8 cmsg_mask; 54 unsigned short channel; 55 unsigned long flags; 56 __u32 cookie; 57 char comm[TASK_COMM_LEN]; 58 __u16 mtu; 59 }; 60 61 static struct hci_dev *hci_hdev_from_sock(struct sock *sk) 62 { 63 struct hci_dev *hdev = hci_pi(sk)->hdev; 64 65 if (!hdev) 66 return ERR_PTR(-EBADFD); 67 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 68 return ERR_PTR(-EPIPE); 69 return hdev; 70 } 71 72 void hci_sock_set_flag(struct sock *sk, int nr) 73 { 74 set_bit(nr, &hci_pi(sk)->flags); 75 } 76 77 void hci_sock_clear_flag(struct sock *sk, int nr) 78 { 79 clear_bit(nr, &hci_pi(sk)->flags); 80 } 81 82 int hci_sock_test_flag(struct sock *sk, int nr) 83 { 84 return test_bit(nr, &hci_pi(sk)->flags); 85 } 86 87 unsigned short hci_sock_get_channel(struct sock *sk) 88 { 89 return hci_pi(sk)->channel; 90 } 91 92 u32 hci_sock_get_cookie(struct sock *sk) 93 { 94 return hci_pi(sk)->cookie; 95 } 96 97 static bool hci_sock_gen_cookie(struct sock *sk) 98 { 99 int id = hci_pi(sk)->cookie; 100 101 if (!id) { 102 id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL); 103 if (id < 0) 104 id = 0xffffffff; 105 106 hci_pi(sk)->cookie = id; 107 get_task_comm(hci_pi(sk)->comm, current); 108 return true; 109 } 110 111 return false; 112 } 113 114 static void hci_sock_free_cookie(struct sock *sk) 115 { 116 int id = hci_pi(sk)->cookie; 117 118 if (id) { 119 hci_pi(sk)->cookie = 0; 120 ida_free(&sock_cookie_ida, id); 121 } 122 } 123 124 static inline int hci_test_bit(int nr, const void *addr) 125 { 126 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 127 } 128 129 /* Security filter */ 130 #define HCI_SFLT_MAX_OGF 5 131 132 struct hci_sec_filter { 133 __u32 type_mask; 134 __u32 event_mask[2]; 135 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4]; 136 }; 137 138 static const struct hci_sec_filter hci_sec_filter = { 139 /* Packet types */ 140 0x10, 141 /* Events */ 142 { 0x1000d9fe, 0x0000b00c }, 143 /* Commands */ 144 { 145 { 0x0 }, 146 /* OGF_LINK_CTL */ 147 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 148 /* OGF_LINK_POLICY */ 149 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 150 /* OGF_HOST_CTL */ 151 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 152 /* OGF_INFO_PARAM */ 153 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 154 /* OGF_STATUS_PARAM */ 155 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 156 } 157 }; 158 159 static struct bt_sock_list hci_sk_list = { 160 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 161 }; 162 163 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) 164 { 165 struct hci_filter *flt; 166 int flt_type, flt_event; 167 u8 event; 168 169 /* Apply filter */ 170 flt = &hci_pi(sk)->filter; 171 172 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS; 173 174 if (!test_bit(flt_type, &flt->type_mask)) 175 return true; 176 177 /* Extra filter for event packets only */ 178 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) 179 return false; 180 181 if (skb->len < 1) 182 return true; 183 184 event = *(__u8 *)skb->data; 185 flt_event = event & HCI_FLT_EVENT_BITS; 186 187 if (!hci_test_bit(flt_event, &flt->event_mask)) 188 return true; 189 190 /* Check filter only when opcode is set */ 191 if (!flt->opcode) 192 return false; 193 194 if (event == HCI_EV_CMD_COMPLETE && skb->len < 5) 195 return true; 196 197 if (event == HCI_EV_CMD_COMPLETE && 198 flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) 199 return true; 200 201 if (event == HCI_EV_CMD_STATUS && skb->len < 6) 202 return true; 203 204 if (event == HCI_EV_CMD_STATUS && 205 flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) 206 return true; 207 208 return false; 209 } 210 211 /* Send frame to RAW socket */ 212 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 213 { 214 struct sock *sk; 215 struct sk_buff *skb_copy = NULL; 216 217 BT_DBG("hdev %p len %d", hdev, skb->len); 218 219 read_lock(&hci_sk_list.lock); 220 221 sk_for_each(sk, &hci_sk_list.head) { 222 struct sk_buff *nskb; 223 224 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 225 continue; 226 227 /* Don't send frame to the socket it came from */ 228 if (skb->sk == sk) 229 continue; 230 231 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { 232 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 233 hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 234 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 235 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 236 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) 237 continue; 238 if (is_filtered_packet(sk, skb)) 239 continue; 240 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 241 if (!bt_cb(skb)->incoming) 242 continue; 243 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 244 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 245 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 246 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 247 hci_skb_pkt_type(skb) != HCI_VENDOR_PKT && 248 hci_skb_pkt_type(skb) != HCI_DRV_PKT) 249 continue; 250 } else { 251 /* Don't send frame to other channel types */ 252 continue; 253 } 254 255 if (!skb_copy) { 256 /* Create a private copy with headroom */ 257 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true); 258 if (!skb_copy) 259 continue; 260 261 /* Put type byte before the data */ 262 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1); 263 } 264 265 nskb = skb_clone(skb_copy, GFP_ATOMIC); 266 if (!nskb) 267 continue; 268 269 if (sock_queue_rcv_skb(sk, nskb)) 270 kfree_skb(nskb); 271 } 272 273 read_unlock(&hci_sk_list.lock); 274 275 kfree_skb(skb_copy); 276 } 277 278 static void hci_sock_copy_creds(struct sock *sk, struct sk_buff *skb) 279 { 280 struct scm_creds *creds; 281 282 if (!sk || WARN_ON(!skb)) 283 return; 284 285 creds = &bt_cb(skb)->creds; 286 287 /* Check if peer credentials is set */ 288 if (!sk->sk_peer_pid[PIDTYPE_TGID]) { 289 /* Check if parent peer credentials is set */ 290 if (bt_sk(sk)->parent && bt_sk(sk)->parent->sk_peer_pid[PIDTYPE_TGID]) 291 sk = bt_sk(sk)->parent; 292 else 293 return; 294 } 295 296 /* Check if scm_creds already set */ 297 if (creds->pid == pid_vnr(sk->sk_peer_pid[PIDTYPE_TGID])) 298 return; 299 300 memset(creds, 0, sizeof(*creds)); 301 302 creds->pid = pid_vnr(sk->sk_peer_pid[PIDTYPE_TGID]); 303 if (sk->sk_peer_cred) { 304 creds->uid = sk->sk_peer_cred->uid; 305 creds->gid = sk->sk_peer_cred->gid; 306 } 307 } 308 309 static struct sk_buff *hci_skb_clone(struct sk_buff *skb) 310 { 311 struct sk_buff *nskb; 312 313 if (!skb) 314 return NULL; 315 316 nskb = skb_clone(skb, GFP_ATOMIC); 317 if (!nskb) 318 return NULL; 319 320 hci_sock_copy_creds(skb->sk, nskb); 321 322 return nskb; 323 } 324 325 /* Send frame to sockets with specific channel */ 326 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 327 int flag, struct sock *skip_sk) 328 { 329 struct sock *sk; 330 331 BT_DBG("channel %u len %d", channel, skb->len); 332 333 sk_for_each(sk, &hci_sk_list.head) { 334 struct sk_buff *nskb; 335 336 /* Ignore socket without the flag set */ 337 if (!hci_sock_test_flag(sk, flag)) 338 continue; 339 340 /* Skip the original socket */ 341 if (sk == skip_sk) 342 continue; 343 344 if (sk->sk_state != BT_BOUND) 345 continue; 346 347 if (hci_pi(sk)->channel != channel) 348 continue; 349 350 nskb = hci_skb_clone(skb); 351 if (!nskb) 352 continue; 353 354 if (sock_queue_rcv_skb(sk, nskb)) 355 kfree_skb(nskb); 356 } 357 358 } 359 360 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 361 int flag, struct sock *skip_sk) 362 { 363 read_lock(&hci_sk_list.lock); 364 __hci_send_to_channel(channel, skb, flag, skip_sk); 365 read_unlock(&hci_sk_list.lock); 366 } 367 368 /* Send frame to monitor socket */ 369 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb) 370 { 371 struct sk_buff *skb_copy = NULL; 372 struct hci_mon_hdr *hdr; 373 __le16 opcode; 374 375 if (!atomic_read(&monitor_promisc)) 376 return; 377 378 BT_DBG("hdev %p len %d", hdev, skb->len); 379 380 switch (hci_skb_pkt_type(skb)) { 381 case HCI_COMMAND_PKT: 382 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT); 383 break; 384 case HCI_EVENT_PKT: 385 opcode = cpu_to_le16(HCI_MON_EVENT_PKT); 386 break; 387 case HCI_ACLDATA_PKT: 388 if (bt_cb(skb)->incoming) 389 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT); 390 else 391 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT); 392 break; 393 case HCI_SCODATA_PKT: 394 if (bt_cb(skb)->incoming) 395 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT); 396 else 397 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT); 398 break; 399 case HCI_ISODATA_PKT: 400 if (bt_cb(skb)->incoming) 401 opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT); 402 else 403 opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT); 404 break; 405 case HCI_VENDOR_PKT: 406 if (bt_cb(skb)->incoming) 407 opcode = cpu_to_le16(HCI_MON_VENDOR_RX_PKT); 408 else 409 opcode = cpu_to_le16(HCI_MON_VENDOR_TX_PKT); 410 break; 411 case HCI_DRV_PKT: 412 if (bt_cb(skb)->incoming) 413 opcode = cpu_to_le16(HCI_MON_DRV_RX_PKT); 414 else 415 opcode = cpu_to_le16(HCI_MON_DRV_TX_PKT); 416 break; 417 case HCI_DIAG_PKT: 418 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG); 419 break; 420 default: 421 return; 422 } 423 424 /* Create a private copy with headroom */ 425 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true); 426 if (!skb_copy) 427 return; 428 429 hci_sock_copy_creds(skb->sk, skb_copy); 430 431 /* Put header before the data */ 432 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE); 433 hdr->opcode = opcode; 434 hdr->index = cpu_to_le16(hdev->id); 435 hdr->len = cpu_to_le16(skb->len); 436 437 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy, 438 HCI_SOCK_TRUSTED, NULL); 439 kfree_skb(skb_copy); 440 } 441 442 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 443 void *data, u16 data_len, ktime_t tstamp, 444 int flag, struct sock *skip_sk) 445 { 446 struct sock *sk; 447 __le16 index; 448 449 if (hdev) 450 index = cpu_to_le16(hdev->id); 451 else 452 index = cpu_to_le16(MGMT_INDEX_NONE); 453 454 read_lock(&hci_sk_list.lock); 455 456 sk_for_each(sk, &hci_sk_list.head) { 457 struct hci_mon_hdr *hdr; 458 struct sk_buff *skb; 459 460 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL) 461 continue; 462 463 /* Ignore socket without the flag set */ 464 if (!hci_sock_test_flag(sk, flag)) 465 continue; 466 467 /* Skip the original socket */ 468 if (sk == skip_sk) 469 continue; 470 471 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC); 472 if (!skb) 473 continue; 474 475 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 476 put_unaligned_le16(event, skb_put(skb, 2)); 477 478 if (data) 479 skb_put_data(skb, data, data_len); 480 481 skb->tstamp = tstamp; 482 483 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 484 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT); 485 hdr->index = index; 486 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 487 488 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 489 HCI_SOCK_TRUSTED, NULL); 490 kfree_skb(skb); 491 } 492 493 read_unlock(&hci_sk_list.lock); 494 } 495 496 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) 497 { 498 struct hci_mon_hdr *hdr; 499 struct hci_mon_new_index *ni; 500 struct hci_mon_index_info *ii; 501 struct sk_buff *skb; 502 __le16 opcode; 503 504 switch (event) { 505 case HCI_DEV_REG: 506 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC); 507 if (!skb) 508 return NULL; 509 510 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); 511 ni->type = 0x00; /* Old hdev->dev_type */ 512 ni->bus = hdev->bus; 513 bacpy(&ni->bdaddr, &hdev->bdaddr); 514 memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, 515 strnlen(hdev->name, sizeof(ni->name)), '\0'); 516 517 opcode = cpu_to_le16(HCI_MON_NEW_INDEX); 518 break; 519 520 case HCI_DEV_UNREG: 521 skb = bt_skb_alloc(0, GFP_ATOMIC); 522 if (!skb) 523 return NULL; 524 525 opcode = cpu_to_le16(HCI_MON_DEL_INDEX); 526 break; 527 528 case HCI_DEV_SETUP: 529 if (hdev->manufacturer == 0xffff) 530 return NULL; 531 fallthrough; 532 533 case HCI_DEV_UP: 534 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC); 535 if (!skb) 536 return NULL; 537 538 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE); 539 bacpy(&ii->bdaddr, &hdev->bdaddr); 540 ii->manufacturer = cpu_to_le16(hdev->manufacturer); 541 542 opcode = cpu_to_le16(HCI_MON_INDEX_INFO); 543 break; 544 545 case HCI_DEV_OPEN: 546 skb = bt_skb_alloc(0, GFP_ATOMIC); 547 if (!skb) 548 return NULL; 549 550 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX); 551 break; 552 553 case HCI_DEV_CLOSE: 554 skb = bt_skb_alloc(0, GFP_ATOMIC); 555 if (!skb) 556 return NULL; 557 558 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX); 559 break; 560 561 default: 562 return NULL; 563 } 564 565 __net_timestamp(skb); 566 567 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 568 hdr->opcode = opcode; 569 hdr->index = cpu_to_le16(hdev->id); 570 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 571 572 return skb; 573 } 574 575 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk) 576 { 577 struct hci_mon_hdr *hdr; 578 struct sk_buff *skb; 579 u16 format; 580 u8 ver[3]; 581 u32 flags; 582 583 /* No message needed when cookie is not present */ 584 if (!hci_pi(sk)->cookie) 585 return NULL; 586 587 switch (hci_pi(sk)->channel) { 588 case HCI_CHANNEL_RAW: 589 format = 0x0000; 590 ver[0] = BT_SUBSYS_VERSION; 591 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 592 break; 593 case HCI_CHANNEL_USER: 594 format = 0x0001; 595 ver[0] = BT_SUBSYS_VERSION; 596 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 597 break; 598 case HCI_CHANNEL_CONTROL: 599 format = 0x0002; 600 mgmt_fill_version_info(ver); 601 break; 602 default: 603 /* No message for unsupported format */ 604 return NULL; 605 } 606 607 skb = bt_skb_alloc(14 + TASK_COMM_LEN, GFP_ATOMIC); 608 if (!skb) 609 return NULL; 610 611 hci_sock_copy_creds(sk, skb); 612 613 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0; 614 615 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 616 put_unaligned_le16(format, skb_put(skb, 2)); 617 skb_put_data(skb, ver, sizeof(ver)); 618 put_unaligned_le32(flags, skb_put(skb, 4)); 619 skb_put_u8(skb, TASK_COMM_LEN); 620 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN); 621 622 __net_timestamp(skb); 623 624 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 625 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN); 626 if (hci_pi(sk)->hdev) 627 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 628 else 629 hdr->index = cpu_to_le16(HCI_DEV_NONE); 630 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 631 632 return skb; 633 } 634 635 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk) 636 { 637 struct hci_mon_hdr *hdr; 638 struct sk_buff *skb; 639 640 /* No message needed when cookie is not present */ 641 if (!hci_pi(sk)->cookie) 642 return NULL; 643 644 switch (hci_pi(sk)->channel) { 645 case HCI_CHANNEL_RAW: 646 case HCI_CHANNEL_USER: 647 case HCI_CHANNEL_CONTROL: 648 break; 649 default: 650 /* No message for unsupported format */ 651 return NULL; 652 } 653 654 skb = bt_skb_alloc(4, GFP_ATOMIC); 655 if (!skb) 656 return NULL; 657 658 hci_sock_copy_creds(sk, skb); 659 660 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 661 662 __net_timestamp(skb); 663 664 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 665 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE); 666 if (hci_pi(sk)->hdev) 667 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 668 else 669 hdr->index = cpu_to_le16(HCI_DEV_NONE); 670 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 671 672 return skb; 673 } 674 675 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index, 676 u16 opcode, u16 len, 677 const void *buf) 678 { 679 struct hci_mon_hdr *hdr; 680 struct sk_buff *skb; 681 682 skb = bt_skb_alloc(6 + len, GFP_ATOMIC); 683 if (!skb) 684 return NULL; 685 686 hci_sock_copy_creds(sk, skb); 687 688 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 689 put_unaligned_le16(opcode, skb_put(skb, 2)); 690 691 if (buf) 692 skb_put_data(skb, buf, len); 693 694 __net_timestamp(skb); 695 696 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 697 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND); 698 hdr->index = cpu_to_le16(index); 699 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 700 701 return skb; 702 } 703 704 static void __printf(2, 3) 705 send_monitor_note(struct sock *sk, const char *fmt, ...) 706 { 707 size_t len; 708 struct hci_mon_hdr *hdr; 709 struct sk_buff *skb; 710 va_list args; 711 712 va_start(args, fmt); 713 len = vsnprintf(NULL, 0, fmt, args); 714 va_end(args); 715 716 skb = bt_skb_alloc(len + 1, GFP_ATOMIC); 717 if (!skb) 718 return; 719 720 hci_sock_copy_creds(sk, skb); 721 722 va_start(args, fmt); 723 vsprintf(skb_put(skb, len), fmt, args); 724 *(u8 *)skb_put(skb, 1) = 0; 725 va_end(args); 726 727 __net_timestamp(skb); 728 729 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE); 730 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE); 731 hdr->index = cpu_to_le16(HCI_DEV_NONE); 732 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 733 734 if (sock_queue_rcv_skb(sk, skb)) 735 kfree_skb(skb); 736 } 737 738 static void send_monitor_replay(struct sock *sk) 739 { 740 struct hci_dev *hdev; 741 742 read_lock(&hci_dev_list_lock); 743 744 list_for_each_entry(hdev, &hci_dev_list, list) { 745 struct sk_buff *skb; 746 747 skb = create_monitor_event(hdev, HCI_DEV_REG); 748 if (!skb) 749 continue; 750 751 if (sock_queue_rcv_skb(sk, skb)) 752 kfree_skb(skb); 753 754 if (!test_bit(HCI_RUNNING, &hdev->flags)) 755 continue; 756 757 skb = create_monitor_event(hdev, HCI_DEV_OPEN); 758 if (!skb) 759 continue; 760 761 if (sock_queue_rcv_skb(sk, skb)) 762 kfree_skb(skb); 763 764 if (test_bit(HCI_UP, &hdev->flags)) 765 skb = create_monitor_event(hdev, HCI_DEV_UP); 766 else if (hci_dev_test_flag(hdev, HCI_SETUP)) 767 skb = create_monitor_event(hdev, HCI_DEV_SETUP); 768 else 769 skb = NULL; 770 771 if (skb) { 772 if (sock_queue_rcv_skb(sk, skb)) 773 kfree_skb(skb); 774 } 775 } 776 777 read_unlock(&hci_dev_list_lock); 778 } 779 780 static void send_monitor_control_replay(struct sock *mon_sk) 781 { 782 struct sock *sk; 783 784 read_lock(&hci_sk_list.lock); 785 786 sk_for_each(sk, &hci_sk_list.head) { 787 struct sk_buff *skb; 788 789 skb = create_monitor_ctrl_open(sk); 790 if (!skb) 791 continue; 792 793 if (sock_queue_rcv_skb(mon_sk, skb)) 794 kfree_skb(skb); 795 } 796 797 read_unlock(&hci_sk_list.lock); 798 } 799 800 /* Generate internal stack event */ 801 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data) 802 { 803 struct hci_event_hdr *hdr; 804 struct hci_ev_stack_internal *ev; 805 struct sk_buff *skb; 806 807 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC); 808 if (!skb) 809 return; 810 811 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE); 812 hdr->evt = HCI_EV_STACK_INTERNAL; 813 hdr->plen = sizeof(*ev) + dlen; 814 815 ev = skb_put(skb, sizeof(*ev) + dlen); 816 ev->type = type; 817 memcpy(ev->data, data, dlen); 818 819 bt_cb(skb)->incoming = 1; 820 __net_timestamp(skb); 821 822 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 823 hci_send_to_sock(hdev, skb); 824 kfree_skb(skb); 825 } 826 827 void hci_sock_dev_event(struct hci_dev *hdev, int event) 828 { 829 BT_DBG("hdev %s event %d", hdev->name, event); 830 831 if (atomic_read(&monitor_promisc)) { 832 struct sk_buff *skb; 833 834 /* Send event to monitor */ 835 skb = create_monitor_event(hdev, event); 836 if (skb) { 837 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 838 HCI_SOCK_TRUSTED, NULL); 839 kfree_skb(skb); 840 } 841 } 842 843 if (event <= HCI_DEV_DOWN) { 844 struct hci_ev_si_device ev; 845 846 /* Send event to sockets */ 847 ev.event = event; 848 ev.dev_id = hdev->id; 849 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 850 } 851 852 if (event == HCI_DEV_UNREG) { 853 struct sock *sk; 854 855 /* Wake up sockets using this dead device */ 856 read_lock(&hci_sk_list.lock); 857 sk_for_each(sk, &hci_sk_list.head) { 858 if (hci_pi(sk)->hdev == hdev) { 859 sk->sk_err = EPIPE; 860 sk->sk_state_change(sk); 861 } 862 } 863 read_unlock(&hci_sk_list.lock); 864 } 865 } 866 867 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel) 868 { 869 struct hci_mgmt_chan *c; 870 871 list_for_each_entry(c, &mgmt_chan_list, list) { 872 if (c->channel == channel) 873 return c; 874 } 875 876 return NULL; 877 } 878 879 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel) 880 { 881 struct hci_mgmt_chan *c; 882 883 mutex_lock(&mgmt_chan_list_lock); 884 c = __hci_mgmt_chan_find(channel); 885 mutex_unlock(&mgmt_chan_list_lock); 886 887 return c; 888 } 889 890 int hci_mgmt_chan_register(struct hci_mgmt_chan *c) 891 { 892 if (c->channel < HCI_CHANNEL_CONTROL) 893 return -EINVAL; 894 895 mutex_lock(&mgmt_chan_list_lock); 896 if (__hci_mgmt_chan_find(c->channel)) { 897 mutex_unlock(&mgmt_chan_list_lock); 898 return -EALREADY; 899 } 900 901 list_add_tail(&c->list, &mgmt_chan_list); 902 903 mutex_unlock(&mgmt_chan_list_lock); 904 905 return 0; 906 } 907 EXPORT_SYMBOL(hci_mgmt_chan_register); 908 909 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c) 910 { 911 mutex_lock(&mgmt_chan_list_lock); 912 list_del(&c->list); 913 mutex_unlock(&mgmt_chan_list_lock); 914 } 915 EXPORT_SYMBOL(hci_mgmt_chan_unregister); 916 917 static int hci_sock_release(struct socket *sock) 918 { 919 struct sock *sk = sock->sk; 920 struct hci_dev *hdev; 921 struct sk_buff *skb; 922 923 BT_DBG("sock %p sk %p", sock, sk); 924 925 if (!sk) 926 return 0; 927 928 lock_sock(sk); 929 930 switch (hci_pi(sk)->channel) { 931 case HCI_CHANNEL_MONITOR: 932 atomic_dec(&monitor_promisc); 933 break; 934 case HCI_CHANNEL_RAW: 935 case HCI_CHANNEL_USER: 936 case HCI_CHANNEL_CONTROL: 937 /* Send event to monitor */ 938 skb = create_monitor_ctrl_close(sk); 939 if (skb) { 940 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 941 HCI_SOCK_TRUSTED, NULL); 942 kfree_skb(skb); 943 } 944 945 hci_sock_free_cookie(sk); 946 break; 947 } 948 949 bt_sock_unlink(&hci_sk_list, sk); 950 951 hdev = hci_pi(sk)->hdev; 952 if (hdev) { 953 if (hci_pi(sk)->channel == HCI_CHANNEL_USER && 954 !hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 955 /* When releasing a user channel exclusive access, 956 * call hci_dev_do_close directly instead of calling 957 * hci_dev_close to ensure the exclusive access will 958 * be released and the controller brought back down. 959 * 960 * The checking of HCI_AUTO_OFF is not needed in this 961 * case since it will have been cleared already when 962 * opening the user channel. 963 * 964 * Make sure to also check that we haven't already 965 * unregistered since all the cleanup will have already 966 * been complete and hdev will get released when we put 967 * below. 968 */ 969 hci_dev_do_close(hdev); 970 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 971 mgmt_index_added(hdev); 972 } 973 974 atomic_dec(&hdev->promisc); 975 hci_dev_put(hdev); 976 } 977 978 sock_orphan(sk); 979 release_sock(sk); 980 sock_put(sk); 981 return 0; 982 } 983 984 static int hci_sock_reject_list_add(struct hci_dev *hdev, void __user *arg) 985 { 986 bdaddr_t bdaddr; 987 int err; 988 989 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 990 return -EFAULT; 991 992 hci_dev_lock(hdev); 993 994 err = hci_bdaddr_list_add(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 995 996 hci_dev_unlock(hdev); 997 998 return err; 999 } 1000 1001 static int hci_sock_reject_list_del(struct hci_dev *hdev, void __user *arg) 1002 { 1003 bdaddr_t bdaddr; 1004 int err; 1005 1006 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 1007 return -EFAULT; 1008 1009 hci_dev_lock(hdev); 1010 1011 err = hci_bdaddr_list_del(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 1012 1013 hci_dev_unlock(hdev); 1014 1015 return err; 1016 } 1017 1018 /* Ioctls that require bound socket */ 1019 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, 1020 unsigned long arg) 1021 { 1022 struct hci_dev *hdev = hci_hdev_from_sock(sk); 1023 1024 if (IS_ERR(hdev)) 1025 return PTR_ERR(hdev); 1026 1027 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 1028 return -EBUSY; 1029 1030 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1031 return -EOPNOTSUPP; 1032 1033 switch (cmd) { 1034 case HCISETRAW: 1035 if (!capable(CAP_NET_ADMIN)) 1036 return -EPERM; 1037 return -EOPNOTSUPP; 1038 1039 case HCIGETCONNINFO: 1040 return hci_get_conn_info(hdev, (void __user *)arg); 1041 1042 case HCIGETAUTHINFO: 1043 return hci_get_auth_info(hdev, (void __user *)arg); 1044 1045 case HCIBLOCKADDR: 1046 if (!capable(CAP_NET_ADMIN)) 1047 return -EPERM; 1048 return hci_sock_reject_list_add(hdev, (void __user *)arg); 1049 1050 case HCIUNBLOCKADDR: 1051 if (!capable(CAP_NET_ADMIN)) 1052 return -EPERM; 1053 return hci_sock_reject_list_del(hdev, (void __user *)arg); 1054 } 1055 1056 return -ENOIOCTLCMD; 1057 } 1058 1059 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, 1060 unsigned long arg) 1061 { 1062 void __user *argp = (void __user *)arg; 1063 struct sock *sk = sock->sk; 1064 int err; 1065 1066 BT_DBG("cmd %x arg %lx", cmd, arg); 1067 1068 /* Make sure the cmd is valid before doing anything */ 1069 switch (cmd) { 1070 case HCIGETDEVLIST: 1071 case HCIGETDEVINFO: 1072 case HCIGETCONNLIST: 1073 case HCIDEVUP: 1074 case HCIDEVDOWN: 1075 case HCIDEVRESET: 1076 case HCIDEVRESTAT: 1077 case HCISETSCAN: 1078 case HCISETAUTH: 1079 case HCISETENCRYPT: 1080 case HCISETPTYPE: 1081 case HCISETLINKPOL: 1082 case HCISETLINKMODE: 1083 case HCISETACLMTU: 1084 case HCISETSCOMTU: 1085 case HCIINQUIRY: 1086 case HCISETRAW: 1087 case HCIGETCONNINFO: 1088 case HCIGETAUTHINFO: 1089 case HCIBLOCKADDR: 1090 case HCIUNBLOCKADDR: 1091 break; 1092 default: 1093 return -ENOIOCTLCMD; 1094 } 1095 1096 lock_sock(sk); 1097 1098 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1099 err = -EBADFD; 1100 goto done; 1101 } 1102 1103 /* When calling an ioctl on an unbound raw socket, then ensure 1104 * that the monitor gets informed. Ensure that the resulting event 1105 * is only send once by checking if the cookie exists or not. The 1106 * socket cookie will be only ever generated once for the lifetime 1107 * of a given socket. 1108 */ 1109 if (hci_sock_gen_cookie(sk)) { 1110 struct sk_buff *skb; 1111 1112 /* Perform careful checks before setting the HCI_SOCK_TRUSTED 1113 * flag. Make sure that not only the current task but also 1114 * the socket opener has the required capability, since 1115 * privileged programs can be tricked into making ioctl calls 1116 * on HCI sockets, and the socket should not be marked as 1117 * trusted simply because the ioctl caller is privileged. 1118 */ 1119 if (sk_capable(sk, CAP_NET_ADMIN)) 1120 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1121 1122 /* Send event to monitor */ 1123 skb = create_monitor_ctrl_open(sk); 1124 if (skb) { 1125 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1126 HCI_SOCK_TRUSTED, NULL); 1127 kfree_skb(skb); 1128 } 1129 } 1130 1131 release_sock(sk); 1132 1133 switch (cmd) { 1134 case HCIGETDEVLIST: 1135 return hci_get_dev_list(argp); 1136 1137 case HCIGETDEVINFO: 1138 return hci_get_dev_info(argp); 1139 1140 case HCIGETCONNLIST: 1141 return hci_get_conn_list(argp); 1142 1143 case HCIDEVUP: 1144 if (!capable(CAP_NET_ADMIN)) 1145 return -EPERM; 1146 return hci_dev_open(arg); 1147 1148 case HCIDEVDOWN: 1149 if (!capable(CAP_NET_ADMIN)) 1150 return -EPERM; 1151 return hci_dev_close(arg); 1152 1153 case HCIDEVRESET: 1154 if (!capable(CAP_NET_ADMIN)) 1155 return -EPERM; 1156 return hci_dev_reset(arg); 1157 1158 case HCIDEVRESTAT: 1159 if (!capable(CAP_NET_ADMIN)) 1160 return -EPERM; 1161 return hci_dev_reset_stat(arg); 1162 1163 case HCISETSCAN: 1164 case HCISETAUTH: 1165 case HCISETENCRYPT: 1166 case HCISETPTYPE: 1167 case HCISETLINKPOL: 1168 case HCISETLINKMODE: 1169 case HCISETACLMTU: 1170 case HCISETSCOMTU: 1171 if (!capable(CAP_NET_ADMIN)) 1172 return -EPERM; 1173 return hci_dev_cmd(cmd, argp); 1174 1175 case HCIINQUIRY: 1176 return hci_inquiry(argp); 1177 } 1178 1179 lock_sock(sk); 1180 1181 err = hci_sock_bound_ioctl(sk, cmd, arg); 1182 1183 done: 1184 release_sock(sk); 1185 return err; 1186 } 1187 1188 #ifdef CONFIG_COMPAT 1189 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd, 1190 unsigned long arg) 1191 { 1192 switch (cmd) { 1193 case HCIDEVUP: 1194 case HCIDEVDOWN: 1195 case HCIDEVRESET: 1196 case HCIDEVRESTAT: 1197 return hci_sock_ioctl(sock, cmd, arg); 1198 } 1199 1200 return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 1201 } 1202 #endif 1203 1204 static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 1205 int addr_len) 1206 { 1207 struct sockaddr_hci haddr; 1208 struct sock *sk = sock->sk; 1209 struct hci_dev *hdev = NULL; 1210 struct sk_buff *skb; 1211 int len, err = 0; 1212 1213 BT_DBG("sock %p sk %p", sock, sk); 1214 1215 if (!addr) 1216 return -EINVAL; 1217 1218 memset(&haddr, 0, sizeof(haddr)); 1219 len = min_t(unsigned int, sizeof(haddr), addr_len); 1220 memcpy(&haddr, addr, len); 1221 1222 if (haddr.hci_family != AF_BLUETOOTH) 1223 return -EINVAL; 1224 1225 lock_sock(sk); 1226 1227 /* Allow detaching from dead device and attaching to alive device, if 1228 * the caller wants to re-bind (instead of close) this socket in 1229 * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. 1230 */ 1231 hdev = hci_pi(sk)->hdev; 1232 if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 1233 write_lock(&hci_sk_list.lock); 1234 hci_pi(sk)->hdev = NULL; 1235 sk->sk_state = BT_OPEN; 1236 write_unlock(&hci_sk_list.lock); 1237 hci_dev_put(hdev); 1238 } 1239 hdev = NULL; 1240 1241 if (sk->sk_state == BT_BOUND) { 1242 err = -EALREADY; 1243 goto done; 1244 } 1245 1246 switch (haddr.hci_channel) { 1247 case HCI_CHANNEL_RAW: 1248 if (hci_pi(sk)->hdev) { 1249 err = -EALREADY; 1250 goto done; 1251 } 1252 1253 if (haddr.hci_dev != HCI_DEV_NONE) { 1254 hdev = hci_dev_get(haddr.hci_dev); 1255 if (!hdev) { 1256 err = -ENODEV; 1257 goto done; 1258 } 1259 1260 atomic_inc(&hdev->promisc); 1261 } 1262 1263 hci_pi(sk)->channel = haddr.hci_channel; 1264 1265 if (!hci_sock_gen_cookie(sk)) { 1266 /* In the case when a cookie has already been assigned, 1267 * then there has been already an ioctl issued against 1268 * an unbound socket and with that triggered an open 1269 * notification. Send a close notification first to 1270 * allow the state transition to bounded. 1271 */ 1272 skb = create_monitor_ctrl_close(sk); 1273 if (skb) { 1274 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1275 HCI_SOCK_TRUSTED, NULL); 1276 kfree_skb(skb); 1277 } 1278 } 1279 1280 if (capable(CAP_NET_ADMIN)) 1281 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1282 1283 hci_pi(sk)->hdev = hdev; 1284 1285 /* Send event to monitor */ 1286 skb = create_monitor_ctrl_open(sk); 1287 if (skb) { 1288 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1289 HCI_SOCK_TRUSTED, NULL); 1290 kfree_skb(skb); 1291 } 1292 break; 1293 1294 case HCI_CHANNEL_USER: 1295 if (hci_pi(sk)->hdev) { 1296 err = -EALREADY; 1297 goto done; 1298 } 1299 1300 if (haddr.hci_dev == HCI_DEV_NONE) { 1301 err = -EINVAL; 1302 goto done; 1303 } 1304 1305 if (!capable(CAP_NET_ADMIN)) { 1306 err = -EPERM; 1307 goto done; 1308 } 1309 1310 hdev = hci_dev_get(haddr.hci_dev); 1311 if (!hdev) { 1312 err = -ENODEV; 1313 goto done; 1314 } 1315 1316 if (test_bit(HCI_INIT, &hdev->flags) || 1317 hci_dev_test_flag(hdev, HCI_SETUP) || 1318 hci_dev_test_flag(hdev, HCI_CONFIG) || 1319 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && 1320 test_bit(HCI_UP, &hdev->flags))) { 1321 err = -EBUSY; 1322 hci_dev_put(hdev); 1323 goto done; 1324 } 1325 1326 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) { 1327 err = -EUSERS; 1328 hci_dev_put(hdev); 1329 goto done; 1330 } 1331 1332 hci_dev_lock(hdev); 1333 mgmt_index_removed(hdev); 1334 hci_dev_unlock(hdev); 1335 1336 err = hci_dev_open(hdev->id); 1337 if (err) { 1338 if (err == -EALREADY) { 1339 /* In case the transport is already up and 1340 * running, clear the error here. 1341 * 1342 * This can happen when opening a user 1343 * channel and HCI_AUTO_OFF grace period 1344 * is still active. 1345 */ 1346 err = 0; 1347 } else { 1348 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 1349 mgmt_index_added(hdev); 1350 hci_dev_put(hdev); 1351 goto done; 1352 } 1353 } 1354 1355 hci_pi(sk)->channel = haddr.hci_channel; 1356 1357 if (!hci_sock_gen_cookie(sk)) { 1358 /* In the case when a cookie has already been assigned, 1359 * this socket will transition from a raw socket into 1360 * a user channel socket. For a clean transition, send 1361 * the close notification first. 1362 */ 1363 skb = create_monitor_ctrl_close(sk); 1364 if (skb) { 1365 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1366 HCI_SOCK_TRUSTED, NULL); 1367 kfree_skb(skb); 1368 } 1369 } 1370 1371 /* The user channel is restricted to CAP_NET_ADMIN 1372 * capabilities and with that implicitly trusted. 1373 */ 1374 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1375 1376 hci_pi(sk)->hdev = hdev; 1377 1378 /* Send event to monitor */ 1379 skb = create_monitor_ctrl_open(sk); 1380 if (skb) { 1381 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1382 HCI_SOCK_TRUSTED, NULL); 1383 kfree_skb(skb); 1384 } 1385 1386 atomic_inc(&hdev->promisc); 1387 break; 1388 1389 case HCI_CHANNEL_MONITOR: 1390 if (haddr.hci_dev != HCI_DEV_NONE) { 1391 err = -EINVAL; 1392 goto done; 1393 } 1394 1395 if (!capable(CAP_NET_RAW)) { 1396 err = -EPERM; 1397 goto done; 1398 } 1399 1400 hci_pi(sk)->channel = haddr.hci_channel; 1401 1402 /* The monitor interface is restricted to CAP_NET_RAW 1403 * capabilities and with that implicitly trusted. 1404 */ 1405 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1406 1407 send_monitor_note(sk, "Linux version %s (%s)", 1408 init_utsname()->release, 1409 init_utsname()->machine); 1410 send_monitor_note(sk, "Bluetooth subsystem version %u.%u", 1411 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION); 1412 send_monitor_replay(sk); 1413 send_monitor_control_replay(sk); 1414 1415 atomic_inc(&monitor_promisc); 1416 break; 1417 1418 case HCI_CHANNEL_LOGGING: 1419 if (haddr.hci_dev != HCI_DEV_NONE) { 1420 err = -EINVAL; 1421 goto done; 1422 } 1423 1424 if (!capable(CAP_NET_ADMIN)) { 1425 err = -EPERM; 1426 goto done; 1427 } 1428 1429 hci_pi(sk)->channel = haddr.hci_channel; 1430 break; 1431 1432 default: 1433 if (!hci_mgmt_chan_find(haddr.hci_channel)) { 1434 err = -EINVAL; 1435 goto done; 1436 } 1437 1438 if (haddr.hci_dev != HCI_DEV_NONE) { 1439 err = -EINVAL; 1440 goto done; 1441 } 1442 1443 /* Users with CAP_NET_ADMIN capabilities are allowed 1444 * access to all management commands and events. For 1445 * untrusted users the interface is restricted and 1446 * also only untrusted events are sent. 1447 */ 1448 if (capable(CAP_NET_ADMIN)) 1449 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1450 1451 hci_pi(sk)->channel = haddr.hci_channel; 1452 1453 /* At the moment the index and unconfigured index events 1454 * are enabled unconditionally. Setting them on each 1455 * socket when binding keeps this functionality. They 1456 * however might be cleared later and then sending of these 1457 * events will be disabled, but that is then intentional. 1458 * 1459 * This also enables generic events that are safe to be 1460 * received by untrusted users. Example for such events 1461 * are changes to settings, class of device, name etc. 1462 */ 1463 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) { 1464 if (!hci_sock_gen_cookie(sk)) { 1465 /* In the case when a cookie has already been 1466 * assigned, this socket will transition from 1467 * a raw socket into a control socket. To 1468 * allow for a clean transition, send the 1469 * close notification first. 1470 */ 1471 skb = create_monitor_ctrl_close(sk); 1472 if (skb) { 1473 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1474 HCI_SOCK_TRUSTED, NULL); 1475 kfree_skb(skb); 1476 } 1477 } 1478 1479 /* Send event to monitor */ 1480 skb = create_monitor_ctrl_open(sk); 1481 if (skb) { 1482 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1483 HCI_SOCK_TRUSTED, NULL); 1484 kfree_skb(skb); 1485 } 1486 1487 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS); 1488 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 1489 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS); 1490 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS); 1491 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1492 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1493 } 1494 break; 1495 } 1496 1497 /* Default MTU to HCI_MAX_FRAME_SIZE if not set */ 1498 if (!hci_pi(sk)->mtu) 1499 hci_pi(sk)->mtu = HCI_MAX_FRAME_SIZE; 1500 1501 sk->sk_state = BT_BOUND; 1502 1503 done: 1504 release_sock(sk); 1505 return err; 1506 } 1507 1508 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, 1509 int peer) 1510 { 1511 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr; 1512 struct sock *sk = sock->sk; 1513 struct hci_dev *hdev; 1514 int err = 0; 1515 1516 BT_DBG("sock %p sk %p", sock, sk); 1517 1518 if (peer) 1519 return -EOPNOTSUPP; 1520 1521 lock_sock(sk); 1522 1523 hdev = hci_hdev_from_sock(sk); 1524 if (IS_ERR(hdev)) { 1525 err = PTR_ERR(hdev); 1526 goto done; 1527 } 1528 1529 haddr->hci_family = AF_BLUETOOTH; 1530 haddr->hci_dev = hdev->id; 1531 haddr->hci_channel= hci_pi(sk)->channel; 1532 err = sizeof(*haddr); 1533 1534 done: 1535 release_sock(sk); 1536 return err; 1537 } 1538 1539 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, 1540 struct sk_buff *skb) 1541 { 1542 __u8 mask = hci_pi(sk)->cmsg_mask; 1543 1544 if (mask & HCI_CMSG_DIR) { 1545 int incoming = bt_cb(skb)->incoming; 1546 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), 1547 &incoming); 1548 } 1549 1550 if (mask & HCI_CMSG_TSTAMP) { 1551 #ifdef CONFIG_COMPAT 1552 struct old_timeval32 ctv; 1553 #endif 1554 struct __kernel_old_timeval tv; 1555 void *data; 1556 int len; 1557 1558 skb_get_timestamp(skb, &tv); 1559 1560 data = &tv; 1561 len = sizeof(tv); 1562 #ifdef CONFIG_COMPAT 1563 if (!COMPAT_USE_64BIT_TIME && 1564 (msg->msg_flags & MSG_CMSG_COMPAT)) { 1565 ctv.tv_sec = tv.tv_sec; 1566 ctv.tv_usec = tv.tv_usec; 1567 data = &ctv; 1568 len = sizeof(ctv); 1569 } 1570 #endif 1571 1572 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 1573 } 1574 } 1575 1576 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1577 size_t len, int flags) 1578 { 1579 struct scm_cookie scm; 1580 struct sock *sk = sock->sk; 1581 struct sk_buff *skb; 1582 int copied, err; 1583 unsigned int skblen; 1584 1585 BT_DBG("sock %p, sk %p", sock, sk); 1586 1587 if (flags & MSG_OOB) 1588 return -EOPNOTSUPP; 1589 1590 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING) 1591 return -EOPNOTSUPP; 1592 1593 if (sk->sk_state == BT_CLOSED) 1594 return 0; 1595 1596 skb = skb_recv_datagram(sk, flags, &err); 1597 if (!skb) 1598 return err; 1599 1600 skblen = skb->len; 1601 copied = skb->len; 1602 if (len < copied) { 1603 msg->msg_flags |= MSG_TRUNC; 1604 copied = len; 1605 } 1606 1607 skb_reset_transport_header(skb); 1608 err = skb_copy_datagram_msg(skb, 0, msg, copied); 1609 1610 switch (hci_pi(sk)->channel) { 1611 case HCI_CHANNEL_RAW: 1612 hci_sock_cmsg(sk, msg, skb); 1613 break; 1614 case HCI_CHANNEL_USER: 1615 case HCI_CHANNEL_MONITOR: 1616 sock_recv_timestamp(msg, sk, skb); 1617 break; 1618 default: 1619 if (hci_mgmt_chan_find(hci_pi(sk)->channel)) 1620 sock_recv_timestamp(msg, sk, skb); 1621 break; 1622 } 1623 1624 memset(&scm, 0, sizeof(scm)); 1625 scm.creds = bt_cb(skb)->creds; 1626 1627 skb_free_datagram(sk, skb); 1628 1629 if (flags & MSG_TRUNC) 1630 copied = skblen; 1631 1632 scm_recv(sock, msg, &scm, flags); 1633 1634 return err ? : copied; 1635 } 1636 1637 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 1638 struct sk_buff *skb) 1639 { 1640 u8 *cp; 1641 struct mgmt_hdr *hdr; 1642 u16 opcode, index, len; 1643 struct hci_dev *hdev = NULL; 1644 const struct hci_mgmt_handler *handler; 1645 bool var_len, no_hdev; 1646 int err; 1647 1648 BT_DBG("got %d bytes", skb->len); 1649 1650 if (skb->len < sizeof(*hdr)) 1651 return -EINVAL; 1652 1653 hdr = (void *)skb->data; 1654 opcode = __le16_to_cpu(hdr->opcode); 1655 index = __le16_to_cpu(hdr->index); 1656 len = __le16_to_cpu(hdr->len); 1657 1658 if (len != skb->len - sizeof(*hdr)) { 1659 err = -EINVAL; 1660 goto done; 1661 } 1662 1663 if (chan->channel == HCI_CHANNEL_CONTROL) { 1664 struct sk_buff *cmd; 1665 1666 /* Send event to monitor */ 1667 cmd = create_monitor_ctrl_command(sk, index, opcode, len, 1668 skb->data + sizeof(*hdr)); 1669 if (cmd) { 1670 hci_send_to_channel(HCI_CHANNEL_MONITOR, cmd, 1671 HCI_SOCK_TRUSTED, NULL); 1672 kfree_skb(cmd); 1673 } 1674 } 1675 1676 if (opcode >= chan->handler_count || 1677 chan->handlers[opcode].func == NULL) { 1678 BT_DBG("Unknown op %u", opcode); 1679 err = mgmt_cmd_status(sk, index, opcode, 1680 MGMT_STATUS_UNKNOWN_COMMAND); 1681 goto done; 1682 } 1683 1684 handler = &chan->handlers[opcode]; 1685 1686 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) && 1687 !(handler->flags & HCI_MGMT_UNTRUSTED)) { 1688 err = mgmt_cmd_status(sk, index, opcode, 1689 MGMT_STATUS_PERMISSION_DENIED); 1690 goto done; 1691 } 1692 1693 if (index != MGMT_INDEX_NONE) { 1694 hdev = hci_dev_get(index); 1695 if (!hdev) { 1696 err = mgmt_cmd_status(sk, index, opcode, 1697 MGMT_STATUS_INVALID_INDEX); 1698 goto done; 1699 } 1700 1701 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1702 hci_dev_test_flag(hdev, HCI_CONFIG) || 1703 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1704 err = mgmt_cmd_status(sk, index, opcode, 1705 MGMT_STATUS_INVALID_INDEX); 1706 goto done; 1707 } 1708 1709 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1710 !(handler->flags & HCI_MGMT_UNCONFIGURED)) { 1711 err = mgmt_cmd_status(sk, index, opcode, 1712 MGMT_STATUS_INVALID_INDEX); 1713 goto done; 1714 } 1715 } 1716 1717 if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) { 1718 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV); 1719 if (no_hdev != !hdev) { 1720 err = mgmt_cmd_status(sk, index, opcode, 1721 MGMT_STATUS_INVALID_INDEX); 1722 goto done; 1723 } 1724 } 1725 1726 var_len = (handler->flags & HCI_MGMT_VAR_LEN); 1727 if ((var_len && len < handler->data_len) || 1728 (!var_len && len != handler->data_len)) { 1729 err = mgmt_cmd_status(sk, index, opcode, 1730 MGMT_STATUS_INVALID_PARAMS); 1731 goto done; 1732 } 1733 1734 if (hdev && chan->hdev_init) 1735 chan->hdev_init(sk, hdev); 1736 1737 cp = skb->data + sizeof(*hdr); 1738 1739 err = handler->func(sk, hdev, cp, len); 1740 if (err < 0) 1741 goto done; 1742 1743 err = skb->len; 1744 1745 done: 1746 if (hdev) 1747 hci_dev_put(hdev); 1748 1749 return err; 1750 } 1751 1752 static int hci_logging_frame(struct sock *sk, struct sk_buff *skb, 1753 unsigned int flags) 1754 { 1755 struct hci_mon_hdr *hdr; 1756 struct hci_dev *hdev; 1757 u16 index; 1758 int err; 1759 1760 /* The logging frame consists at minimum of the standard header, 1761 * the priority byte, the ident length byte and at least one string 1762 * terminator NUL byte. Anything shorter are invalid packets. 1763 */ 1764 if (skb->len < sizeof(*hdr) + 3) 1765 return -EINVAL; 1766 1767 hdr = (void *)skb->data; 1768 1769 if (__le16_to_cpu(hdr->len) != skb->len - sizeof(*hdr)) 1770 return -EINVAL; 1771 1772 if (__le16_to_cpu(hdr->opcode) == 0x0000) { 1773 __u8 priority = skb->data[sizeof(*hdr)]; 1774 __u8 ident_len = skb->data[sizeof(*hdr) + 1]; 1775 1776 /* Only the priorities 0-7 are valid and with that any other 1777 * value results in an invalid packet. 1778 * 1779 * The priority byte is followed by an ident length byte and 1780 * the NUL terminated ident string. Check that the ident 1781 * length is not overflowing the packet and also that the 1782 * ident string itself is NUL terminated. In case the ident 1783 * length is zero, the length value actually doubles as NUL 1784 * terminator identifier. 1785 * 1786 * The message follows the ident string (if present) and 1787 * must be NUL terminated. Otherwise it is not a valid packet. 1788 */ 1789 if (priority > 7 || skb->data[skb->len - 1] != 0x00 || 1790 ident_len > skb->len - sizeof(*hdr) - 3 || 1791 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) 1792 return -EINVAL; 1793 } else { 1794 return -EINVAL; 1795 } 1796 1797 index = __le16_to_cpu(hdr->index); 1798 1799 if (index != MGMT_INDEX_NONE) { 1800 hdev = hci_dev_get(index); 1801 if (!hdev) 1802 return -ENODEV; 1803 } else { 1804 hdev = NULL; 1805 } 1806 1807 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING); 1808 1809 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL); 1810 err = skb->len; 1811 1812 if (hdev) 1813 hci_dev_put(hdev); 1814 1815 return err; 1816 } 1817 1818 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1819 size_t len) 1820 { 1821 struct sock *sk = sock->sk; 1822 struct hci_mgmt_chan *chan; 1823 struct hci_dev *hdev; 1824 struct sk_buff *skb; 1825 int err; 1826 const unsigned int flags = msg->msg_flags; 1827 1828 BT_DBG("sock %p sk %p", sock, sk); 1829 1830 if (flags & MSG_OOB) 1831 return -EOPNOTSUPP; 1832 1833 if (flags & ~(MSG_DONTWAIT | MSG_NOSIGNAL | MSG_ERRQUEUE | MSG_CMSG_COMPAT)) 1834 return -EINVAL; 1835 1836 if (len < 4 || len > hci_pi(sk)->mtu) 1837 return -EINVAL; 1838 1839 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 1840 if (IS_ERR(skb)) 1841 return PTR_ERR(skb); 1842 1843 lock_sock(sk); 1844 1845 switch (hci_pi(sk)->channel) { 1846 case HCI_CHANNEL_RAW: 1847 case HCI_CHANNEL_USER: 1848 break; 1849 case HCI_CHANNEL_MONITOR: 1850 err = -EOPNOTSUPP; 1851 goto drop; 1852 case HCI_CHANNEL_LOGGING: 1853 err = hci_logging_frame(sk, skb, flags); 1854 goto drop; 1855 default: 1856 mutex_lock(&mgmt_chan_list_lock); 1857 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel); 1858 if (chan) 1859 err = hci_mgmt_cmd(chan, sk, skb); 1860 else 1861 err = -EINVAL; 1862 1863 mutex_unlock(&mgmt_chan_list_lock); 1864 goto drop; 1865 } 1866 1867 hdev = hci_hdev_from_sock(sk); 1868 if (IS_ERR(hdev)) { 1869 err = PTR_ERR(hdev); 1870 goto drop; 1871 } 1872 1873 if (!test_bit(HCI_UP, &hdev->flags)) { 1874 err = -ENETDOWN; 1875 goto drop; 1876 } 1877 1878 hci_skb_pkt_type(skb) = skb->data[0]; 1879 skb_pull(skb, 1); 1880 1881 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 1882 /* No permission check is needed for user channel 1883 * since that gets enforced when binding the socket. 1884 * 1885 * However check that the packet type is valid. 1886 */ 1887 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 1888 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1889 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1890 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 1891 hci_skb_pkt_type(skb) != HCI_VENDOR_PKT && 1892 hci_skb_pkt_type(skb) != HCI_DRV_PKT) { 1893 err = -EINVAL; 1894 goto drop; 1895 } 1896 1897 skb_queue_tail(&hdev->raw_q, skb); 1898 queue_work(hdev->workqueue, &hdev->tx_work); 1899 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) { 1900 u16 opcode = get_unaligned_le16(skb->data); 1901 u16 ogf = hci_opcode_ogf(opcode); 1902 u16 ocf = hci_opcode_ocf(opcode); 1903 1904 if (((ogf > HCI_SFLT_MAX_OGF) || 1905 (ocf > HCI_FLT_OCF_BITS) || 1906 !hci_test_bit(ocf, 1907 &hci_sec_filter.ocf_mask[ogf])) && 1908 !capable(CAP_NET_RAW)) { 1909 err = -EPERM; 1910 goto drop; 1911 } 1912 1913 /* Since the opcode has already been extracted here, store 1914 * a copy of the value for later use by the drivers. 1915 */ 1916 hci_skb_opcode(skb) = opcode; 1917 1918 if (ogf == 0x3f) { 1919 skb_queue_tail(&hdev->raw_q, skb); 1920 queue_work(hdev->workqueue, &hdev->tx_work); 1921 } else { 1922 /* Stand-alone HCI commands must be flagged as 1923 * single-command requests. 1924 */ 1925 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 1926 1927 skb_queue_tail(&hdev->cmd_q, skb); 1928 queue_work(hdev->workqueue, &hdev->cmd_work); 1929 } 1930 } else { 1931 if (!capable(CAP_NET_RAW)) { 1932 err = -EPERM; 1933 goto drop; 1934 } 1935 1936 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1937 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1938 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { 1939 err = -EINVAL; 1940 goto drop; 1941 } 1942 1943 skb_queue_tail(&hdev->raw_q, skb); 1944 queue_work(hdev->workqueue, &hdev->tx_work); 1945 } 1946 1947 err = len; 1948 1949 done: 1950 release_sock(sk); 1951 return err; 1952 1953 drop: 1954 kfree_skb(skb); 1955 goto done; 1956 } 1957 1958 static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 1959 sockptr_t optval, unsigned int optlen) 1960 { 1961 struct hci_ufilter uf = { .opcode = 0 }; 1962 struct sock *sk = sock->sk; 1963 int err = 0, opt = 0; 1964 1965 BT_DBG("sk %p, opt %d", sk, optname); 1966 1967 lock_sock(sk); 1968 1969 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1970 err = -EBADFD; 1971 goto done; 1972 } 1973 1974 switch (optname) { 1975 case HCI_DATA_DIR: 1976 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1977 if (err) 1978 break; 1979 1980 if (opt) 1981 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 1982 else 1983 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 1984 break; 1985 1986 case HCI_TIME_STAMP: 1987 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1988 if (err) 1989 break; 1990 1991 if (opt) 1992 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 1993 else 1994 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 1995 break; 1996 1997 case HCI_FILTER: 1998 { 1999 struct hci_filter *f = &hci_pi(sk)->filter; 2000 2001 uf.type_mask = f->type_mask; 2002 uf.opcode = f->opcode; 2003 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 2004 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 2005 } 2006 2007 err = copy_safe_from_sockptr(&uf, sizeof(uf), optval, optlen); 2008 if (err) 2009 break; 2010 2011 if (!capable(CAP_NET_RAW)) { 2012 uf.type_mask &= hci_sec_filter.type_mask; 2013 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 2014 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 2015 } 2016 2017 { 2018 struct hci_filter *f = &hci_pi(sk)->filter; 2019 2020 f->type_mask = uf.type_mask; 2021 f->opcode = uf.opcode; 2022 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 2023 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 2024 } 2025 break; 2026 2027 default: 2028 err = -ENOPROTOOPT; 2029 break; 2030 } 2031 2032 done: 2033 release_sock(sk); 2034 return err; 2035 } 2036 2037 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 2038 sockptr_t optval, unsigned int optlen) 2039 { 2040 struct sock *sk = sock->sk; 2041 int err = 0; 2042 u16 opt; 2043 2044 BT_DBG("sk %p, opt %d", sk, optname); 2045 2046 if (level == SOL_HCI) 2047 return hci_sock_setsockopt_old(sock, level, optname, optval, 2048 optlen); 2049 2050 if (level != SOL_BLUETOOTH) 2051 return -ENOPROTOOPT; 2052 2053 lock_sock(sk); 2054 2055 switch (optname) { 2056 case BT_SNDMTU: 2057 case BT_RCVMTU: 2058 switch (hci_pi(sk)->channel) { 2059 /* Don't allow changing MTU for channels that are meant for HCI 2060 * traffic only. 2061 */ 2062 case HCI_CHANNEL_RAW: 2063 case HCI_CHANNEL_USER: 2064 err = -ENOPROTOOPT; 2065 goto done; 2066 } 2067 2068 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 2069 if (err) 2070 break; 2071 2072 hci_pi(sk)->mtu = opt; 2073 break; 2074 2075 default: 2076 err = -ENOPROTOOPT; 2077 break; 2078 } 2079 2080 done: 2081 release_sock(sk); 2082 return err; 2083 } 2084 2085 static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname, 2086 sockopt_t *sopt) 2087 { 2088 struct hci_ufilter uf; 2089 struct sock *sk = sock->sk; 2090 int len, opt, err = 0; 2091 2092 BT_DBG("sk %p, opt %d", sk, optname); 2093 2094 len = sopt->optlen; 2095 2096 lock_sock(sk); 2097 2098 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 2099 err = -EBADFD; 2100 goto done; 2101 } 2102 2103 switch (optname) { 2104 case HCI_DATA_DIR: 2105 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 2106 opt = 1; 2107 else 2108 opt = 0; 2109 2110 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2111 sizeof(opt)) 2112 err = -EFAULT; 2113 break; 2114 2115 case HCI_TIME_STAMP: 2116 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 2117 opt = 1; 2118 else 2119 opt = 0; 2120 2121 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2122 sizeof(opt)) 2123 err = -EFAULT; 2124 break; 2125 2126 case HCI_FILTER: 2127 { 2128 struct hci_filter *f = &hci_pi(sk)->filter; 2129 2130 memset(&uf, 0, sizeof(uf)); 2131 uf.type_mask = f->type_mask; 2132 uf.opcode = f->opcode; 2133 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 2134 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 2135 } 2136 2137 len = min_t(unsigned int, len, sizeof(uf)); 2138 if (copy_to_iter(&uf, len, &sopt->iter_out) != len) 2139 err = -EFAULT; 2140 break; 2141 2142 default: 2143 err = -ENOPROTOOPT; 2144 break; 2145 } 2146 2147 done: 2148 release_sock(sk); 2149 return err; 2150 } 2151 2152 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, 2153 sockopt_t *sopt) 2154 { 2155 struct sock *sk = sock->sk; 2156 int err = 0; 2157 u16 mtu; 2158 2159 BT_DBG("sk %p, opt %d", sk, optname); 2160 2161 if (level == SOL_HCI) 2162 return hci_sock_getsockopt_old(sock, level, optname, sopt); 2163 2164 if (level != SOL_BLUETOOTH) 2165 return -ENOPROTOOPT; 2166 2167 lock_sock(sk); 2168 2169 switch (optname) { 2170 case BT_SNDMTU: 2171 case BT_RCVMTU: 2172 mtu = hci_pi(sk)->mtu; 2173 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 2174 sizeof(mtu)) 2175 err = -EFAULT; 2176 break; 2177 2178 default: 2179 err = -ENOPROTOOPT; 2180 break; 2181 } 2182 2183 release_sock(sk); 2184 return err; 2185 } 2186 2187 static void hci_sock_destruct(struct sock *sk) 2188 { 2189 mgmt_cleanup(sk); 2190 skb_queue_purge(&sk->sk_receive_queue); 2191 skb_queue_purge(&sk->sk_write_queue); 2192 skb_queue_purge(&sk->sk_error_queue); 2193 } 2194 2195 static const struct proto_ops hci_sock_ops = { 2196 .family = PF_BLUETOOTH, 2197 .owner = THIS_MODULE, 2198 .release = hci_sock_release, 2199 .bind = hci_sock_bind, 2200 .getname = hci_sock_getname, 2201 .sendmsg = hci_sock_sendmsg, 2202 .recvmsg = hci_sock_recvmsg, 2203 .ioctl = hci_sock_ioctl, 2204 #ifdef CONFIG_COMPAT 2205 .compat_ioctl = hci_sock_compat_ioctl, 2206 #endif 2207 .poll = datagram_poll, 2208 .listen = sock_no_listen, 2209 .shutdown = sock_no_shutdown, 2210 .setsockopt = hci_sock_setsockopt, 2211 .getsockopt_iter = hci_sock_getsockopt, 2212 .connect = sock_no_connect, 2213 .socketpair = sock_no_socketpair, 2214 .accept = sock_no_accept, 2215 .mmap = sock_no_mmap 2216 }; 2217 2218 static struct proto hci_sk_proto = { 2219 .name = "HCI", 2220 .owner = THIS_MODULE, 2221 .obj_size = sizeof(struct hci_pinfo) 2222 }; 2223 2224 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 2225 int kern) 2226 { 2227 struct sock *sk; 2228 2229 BT_DBG("sock %p", sock); 2230 2231 if (sock->type != SOCK_RAW) 2232 return -ESOCKTNOSUPPORT; 2233 2234 sock->ops = &hci_sock_ops; 2235 2236 sk = bt_sock_alloc(net, sock, &hci_sk_proto, protocol, GFP_ATOMIC, 2237 kern); 2238 if (!sk) 2239 return -ENOMEM; 2240 2241 sock->state = SS_UNCONNECTED; 2242 sk->sk_destruct = hci_sock_destruct; 2243 2244 bt_sock_link(&hci_sk_list, sk); 2245 return 0; 2246 } 2247 2248 static const struct net_proto_family hci_sock_family_ops = { 2249 .family = PF_BLUETOOTH, 2250 .owner = THIS_MODULE, 2251 .create = hci_sock_create, 2252 }; 2253 2254 int __init hci_sock_init(void) 2255 { 2256 int err; 2257 2258 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr)); 2259 2260 err = proto_register(&hci_sk_proto, 0); 2261 if (err < 0) 2262 return err; 2263 2264 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 2265 if (err < 0) { 2266 BT_ERR("HCI socket registration failed"); 2267 goto error; 2268 } 2269 2270 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL); 2271 if (err < 0) { 2272 BT_ERR("Failed to create HCI proc file"); 2273 bt_sock_unregister(BTPROTO_HCI); 2274 goto error; 2275 } 2276 2277 BT_INFO("HCI socket layer initialized"); 2278 2279 return 0; 2280 2281 error: 2282 proto_unregister(&hci_sk_proto); 2283 return err; 2284 } 2285 2286 void hci_sock_cleanup(void) 2287 { 2288 bt_procfs_cleanup(&init_net, "hci"); 2289 bt_sock_unregister(BTPROTO_HCI); 2290 proto_unregister(&hci_sk_proto); 2291 } 2292