1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
6
7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15
16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
18 SOFTWARE IS DISCLAIMED.
19 */
20
21 /*
22 * RFCOMM sockets.
23 */
24 #include <linux/compat.h>
25 #include <linux/export.h>
26 #include <linux/debugfs.h>
27 #include <linux/sched/signal.h>
28 #include <linux/uio.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33 #include <net/bluetooth/rfcomm.h>
34
35 static const struct proto_ops rfcomm_sock_ops;
36
37 static struct bt_sock_list rfcomm_sk_list = {
38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
39 };
40
41 static void rfcomm_sock_close(struct sock *sk);
42 static void rfcomm_sock_kill(struct sock *sk);
43
44 /* ---- DLC callbacks ----
45 *
46 * called under rfcomm_dlc_lock()
47 */
rfcomm_sk_data_ready(struct rfcomm_dlc * d,struct sk_buff * skb)48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
49 {
50 struct sock *sk = d->owner;
51 if (!sk)
52 return;
53
54 atomic_add(skb->len, &sk->sk_rmem_alloc);
55 skb_queue_tail(&sk->sk_receive_queue, skb);
56 sk->sk_data_ready(sk);
57
58 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
59 rfcomm_dlc_throttle(d);
60 }
61
rfcomm_sk_state_change(struct rfcomm_dlc * d,int err)62 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
63 __must_hold(&d->lock)
64 {
65 struct sock *sk = d->owner, *parent;
66
67 if (!sk)
68 return;
69
70 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
71
72 lock_sock(sk);
73
74 if (err)
75 sk->sk_err = err;
76
77 sk->sk_state = d->state;
78
79 parent = bt_sk(sk)->parent;
80 if (parent) {
81 if (d->state == BT_CLOSED) {
82 sock_set_flag(sk, SOCK_ZAPPED);
83 bt_accept_unlink(sk);
84 }
85 parent->sk_data_ready(parent);
86 } else {
87 if (d->state == BT_CONNECTED)
88 rfcomm_session_getaddr(d->session,
89 &rfcomm_pi(sk)->src, NULL);
90 sk->sk_state_change(sk);
91 }
92
93 release_sock(sk);
94
95 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
96 /* We have to drop DLC lock here, otherwise
97 * rfcomm_sock_destruct() will dead lock. */
98 rfcomm_dlc_unlock(d);
99 rfcomm_sock_kill(sk);
100 rfcomm_dlc_lock(d);
101 }
102 }
103
104 /* ---- Socket functions ---- */
__rfcomm_get_listen_sock_by_addr(u8 channel,bdaddr_t * src)105 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
106 {
107 struct sock *sk = NULL;
108
109 sk_for_each(sk, &rfcomm_sk_list.head) {
110 if (rfcomm_pi(sk)->channel != channel)
111 continue;
112
113 if (bacmp(&rfcomm_pi(sk)->src, src))
114 continue;
115
116 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
117 break;
118 }
119
120 return sk ? sk : NULL;
121 }
122
123 /* Find socket with channel and source bdaddr.
124 * Returns closest match with an extra reference held.
125 */
rfcomm_get_sock_by_channel(int state,u8 channel,bdaddr_t * src)126 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
127 {
128 struct sock *sk = NULL, *sk1 = NULL;
129
130 read_lock(&rfcomm_sk_list.lock);
131
132 sk_for_each(sk, &rfcomm_sk_list.head) {
133 if (state && sk->sk_state != state)
134 continue;
135
136 if (rfcomm_pi(sk)->channel == channel) {
137 /* Exact match. */
138 if (!bacmp(&rfcomm_pi(sk)->src, src)) {
139 sock_hold(sk);
140 break;
141 }
142
143 /* Closest match */
144 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) {
145 if (sk1)
146 sock_put(sk1);
147
148 sk1 = sk;
149 sock_hold(sk1);
150 }
151 }
152 }
153
154 if (sk && sk1)
155 sock_put(sk1);
156
157 read_unlock(&rfcomm_sk_list.lock);
158
159 return sk ? sk : sk1;
160 }
161
rfcomm_sock_destruct(struct sock * sk)162 static void rfcomm_sock_destruct(struct sock *sk)
163 {
164 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
165
166 BT_DBG("sk %p dlc %p", sk, d);
167
168 skb_queue_purge(&sk->sk_receive_queue);
169 skb_queue_purge(&sk->sk_write_queue);
170
171 rfcomm_dlc_lock(d);
172 rfcomm_pi(sk)->dlc = NULL;
173
174 /* Detach DLC if it's owned by this socket */
175 if (d->owner == sk)
176 d->owner = NULL;
177 rfcomm_dlc_unlock(d);
178
179 rfcomm_dlc_put(d);
180 }
181
rfcomm_sock_cleanup_listen(struct sock * parent)182 static void rfcomm_sock_cleanup_listen(struct sock *parent)
183 {
184 struct sock *sk;
185
186 BT_DBG("parent %p", parent);
187
188 /* Close not yet accepted dlcs */
189 while ((sk = bt_accept_dequeue(parent, NULL))) {
190 rfcomm_sock_close(sk);
191 rfcomm_sock_kill(sk);
192 /* Drop the reference handed back by bt_accept_dequeue(). */
193 sock_put(sk);
194 }
195
196 parent->sk_state = BT_CLOSED;
197 sock_set_flag(parent, SOCK_ZAPPED);
198 }
199
200 /* Kill socket (only if zapped and orphan)
201 * Must be called on unlocked socket.
202 */
rfcomm_sock_kill(struct sock * sk)203 static void rfcomm_sock_kill(struct sock *sk)
204 {
205 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
206 return;
207
208 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
209
210 /* Kill poor orphan */
211 bt_sock_unlink(&rfcomm_sk_list, sk);
212 sock_set_flag(sk, SOCK_DEAD);
213 sock_put(sk);
214 }
215
__rfcomm_sock_close(struct sock * sk)216 static void __rfcomm_sock_close(struct sock *sk)
217 {
218 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
219
220 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
221
222 switch (sk->sk_state) {
223 case BT_LISTEN:
224 rfcomm_sock_cleanup_listen(sk);
225 break;
226
227 case BT_CONNECT:
228 case BT_CONNECT2:
229 case BT_CONFIG:
230 case BT_CONNECTED:
231 rfcomm_dlc_close(d, 0);
232 fallthrough;
233
234 default:
235 sock_set_flag(sk, SOCK_ZAPPED);
236 break;
237 }
238 }
239
240 /* Close socket.
241 * Must be called on unlocked socket.
242 */
rfcomm_sock_close(struct sock * sk)243 static void rfcomm_sock_close(struct sock *sk)
244 {
245 lock_sock(sk);
246 __rfcomm_sock_close(sk);
247 release_sock(sk);
248 }
249
rfcomm_sock_init(struct sock * sk,struct sock * parent)250 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
251 {
252 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
253
254 BT_DBG("sk %p", sk);
255
256 if (parent) {
257 sk->sk_type = parent->sk_type;
258 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
259 &bt_sk(parent)->flags);
260
261 pi->sec_level = rfcomm_pi(parent)->sec_level;
262 pi->role_switch = rfcomm_pi(parent)->role_switch;
263
264 security_sk_clone(parent, sk);
265 } else {
266 pi->dlc->defer_setup = 0;
267
268 pi->sec_level = BT_SECURITY_LOW;
269 pi->role_switch = 0;
270 }
271
272 pi->dlc->sec_level = pi->sec_level;
273 pi->dlc->role_switch = pi->role_switch;
274 }
275
276 static struct proto rfcomm_proto = {
277 .name = "RFCOMM",
278 .owner = THIS_MODULE,
279 .obj_size = sizeof(struct rfcomm_pinfo)
280 };
281
rfcomm_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)282 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,
283 int proto, gfp_t prio, int kern)
284 {
285 struct rfcomm_dlc *d;
286 struct sock *sk;
287
288 d = rfcomm_dlc_alloc(prio);
289 if (!d)
290 return NULL;
291
292 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
293 if (!sk) {
294 rfcomm_dlc_free(d);
295 return NULL;
296 }
297
298 d->data_ready = rfcomm_sk_data_ready;
299 d->state_change = rfcomm_sk_state_change;
300
301 rfcomm_pi(sk)->dlc = d;
302 d->owner = sk;
303
304 sk->sk_destruct = rfcomm_sock_destruct;
305 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
306
307 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
308 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
309
310 bt_sock_link(&rfcomm_sk_list, sk);
311
312 BT_DBG("sk %p", sk);
313 return sk;
314 }
315
rfcomm_sock_create(struct net * net,struct socket * sock,int protocol,int kern)316 static int rfcomm_sock_create(struct net *net, struct socket *sock,
317 int protocol, int kern)
318 {
319 struct sock *sk;
320
321 BT_DBG("sock %p", sock);
322
323 sock->state = SS_UNCONNECTED;
324
325 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
326 return -ESOCKTNOSUPPORT;
327
328 sock->ops = &rfcomm_sock_ops;
329
330 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
331 if (!sk)
332 return -ENOMEM;
333
334 rfcomm_sock_init(sk, NULL);
335 return 0;
336 }
337
rfcomm_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int addr_len)338 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
339 {
340 struct sockaddr_rc sa;
341 struct sock *sk = sock->sk;
342 int len, err = 0;
343
344 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
345 addr->sa_family != AF_BLUETOOTH)
346 return -EINVAL;
347
348 memset(&sa, 0, sizeof(sa));
349 len = min_t(unsigned int, sizeof(sa), addr_len);
350 memcpy(&sa, addr, len);
351
352 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
353
354 lock_sock(sk);
355
356 if (sk->sk_state != BT_OPEN) {
357 err = -EBADFD;
358 goto done;
359 }
360
361 if (sk->sk_type != SOCK_STREAM) {
362 err = -EINVAL;
363 goto done;
364 }
365
366 write_lock(&rfcomm_sk_list.lock);
367
368 if (sa.rc_channel &&
369 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
370 err = -EADDRINUSE;
371 } else {
372 /* Save source address */
373 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
374 rfcomm_pi(sk)->channel = sa.rc_channel;
375 sk->sk_state = BT_BOUND;
376 }
377
378 write_unlock(&rfcomm_sk_list.lock);
379
380 done:
381 release_sock(sk);
382 return err;
383 }
384
rfcomm_sock_connect(struct socket * sock,struct sockaddr_unsized * addr,int alen,int flags)385 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
386 int alen, int flags)
387 {
388 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
389 struct sock *sk = sock->sk;
390 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
391 int err = 0;
392
393 BT_DBG("sk %p", sk);
394
395 if (alen < sizeof(struct sockaddr_rc) ||
396 addr->sa_family != AF_BLUETOOTH)
397 return -EINVAL;
398
399 sock_hold(sk);
400 lock_sock(sk);
401
402 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
403 err = -EBADFD;
404 goto done;
405 }
406
407 if (sk->sk_type != SOCK_STREAM) {
408 err = -EINVAL;
409 goto done;
410 }
411
412 sk->sk_state = BT_CONNECT;
413 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
414 rfcomm_pi(sk)->channel = sa->rc_channel;
415
416 d->sec_level = rfcomm_pi(sk)->sec_level;
417 d->role_switch = rfcomm_pi(sk)->role_switch;
418
419 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */
420 release_sock(sk);
421 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
422 sa->rc_channel);
423 lock_sock(sk);
424 if (!err && !sock_flag(sk, SOCK_ZAPPED))
425 err = bt_sock_wait_state(sk, BT_CONNECTED,
426 sock_sndtimeo(sk, flags & O_NONBLOCK));
427
428 done:
429 release_sock(sk);
430 sock_put(sk);
431 return err;
432 }
433
rfcomm_sock_listen(struct socket * sock,int backlog)434 static int rfcomm_sock_listen(struct socket *sock, int backlog)
435 {
436 struct sock *sk = sock->sk;
437 int err = 0;
438
439 BT_DBG("sk %p backlog %d", sk, backlog);
440
441 lock_sock(sk);
442
443 if (sk->sk_state != BT_BOUND) {
444 err = -EBADFD;
445 goto done;
446 }
447
448 if (sk->sk_type != SOCK_STREAM) {
449 err = -EINVAL;
450 goto done;
451 }
452
453 if (!rfcomm_pi(sk)->channel) {
454 bdaddr_t *src = &rfcomm_pi(sk)->src;
455 u8 channel;
456
457 err = -EINVAL;
458
459 write_lock(&rfcomm_sk_list.lock);
460
461 for (channel = 1; channel < 31; channel++)
462 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
463 rfcomm_pi(sk)->channel = channel;
464 err = 0;
465 break;
466 }
467
468 write_unlock(&rfcomm_sk_list.lock);
469
470 if (err < 0)
471 goto done;
472 }
473
474 sk->sk_max_ack_backlog = backlog;
475 sk->sk_ack_backlog = 0;
476 sk->sk_state = BT_LISTEN;
477
478 done:
479 release_sock(sk);
480 return err;
481 }
482
rfcomm_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)483 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock,
484 struct proto_accept_arg *arg)
485 {
486 DEFINE_WAIT_FUNC(wait, woken_wake_function);
487 struct sock *sk = sock->sk, *nsk;
488 long timeo;
489 int err = 0;
490
491 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
492
493 if (sk->sk_type != SOCK_STREAM) {
494 err = -EINVAL;
495 goto done;
496 }
497
498 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
499
500 BT_DBG("sk %p timeo %ld", sk, timeo);
501
502 /* Wait for an incoming connection. (wake-one). */
503 add_wait_queue_exclusive(sk_sleep(sk), &wait);
504 while (1) {
505 if (sk->sk_state != BT_LISTEN) {
506 err = -EBADFD;
507 break;
508 }
509
510 nsk = bt_accept_dequeue(sk, newsock);
511 if (nsk) {
512 /* Drop the bridging ref from bt_accept_dequeue();
513 * the grafted socket keeps nsk alive from here.
514 */
515 sock_put(nsk);
516 break;
517 }
518
519 if (!timeo) {
520 err = -EAGAIN;
521 break;
522 }
523
524 if (signal_pending(current)) {
525 err = sock_intr_errno(timeo);
526 break;
527 }
528
529 release_sock(sk);
530
531 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
532
533 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
534 }
535 remove_wait_queue(sk_sleep(sk), &wait);
536
537 if (err)
538 goto done;
539
540 newsock->state = SS_CONNECTED;
541
542 BT_DBG("new socket %p", nsk);
543
544 done:
545 release_sock(sk);
546 return err;
547 }
548
rfcomm_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)549 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
550 {
551 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
552 struct sock *sk = sock->sk;
553
554 BT_DBG("sock %p, sk %p", sock, sk);
555
556 if (peer && sk->sk_state != BT_CONNECTED &&
557 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
558 return -ENOTCONN;
559
560 memset(sa, 0, sizeof(*sa));
561 sa->rc_family = AF_BLUETOOTH;
562 sa->rc_channel = rfcomm_pi(sk)->channel;
563 if (peer)
564 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
565 else
566 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
567
568 return sizeof(struct sockaddr_rc);
569 }
570
rfcomm_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)571 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
572 size_t len)
573 {
574 struct sock *sk = sock->sk;
575 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
576 struct sk_buff *skb;
577 int sent;
578
579 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
580 return -ENOTCONN;
581
582 if (msg->msg_flags & MSG_OOB)
583 return -EOPNOTSUPP;
584
585 if (sk->sk_shutdown & SEND_SHUTDOWN)
586 return -EPIPE;
587
588 BT_DBG("sock %p, sk %p", sock, sk);
589
590 lock_sock(sk);
591
592 sent = bt_sock_wait_ready(sk, msg->msg_flags);
593
594 release_sock(sk);
595
596 if (sent)
597 return sent;
598
599 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
600 RFCOMM_SKB_TAIL_RESERVE);
601 if (IS_ERR(skb))
602 return PTR_ERR(skb);
603
604 sent = rfcomm_dlc_send(d, skb);
605 if (sent < 0)
606 kfree_skb(skb);
607
608 return sent;
609 }
610
rfcomm_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t size,int flags)611 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
612 size_t size, int flags)
613 {
614 struct sock *sk = sock->sk;
615 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
616 int len;
617
618 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
619 rfcomm_dlc_accept(d);
620 return 0;
621 }
622
623 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
624
625 lock_sock(sk);
626 if (!(flags & MSG_PEEK) && len > 0)
627 atomic_sub(len, &sk->sk_rmem_alloc);
628
629 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
630 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
631 release_sock(sk);
632
633 return len;
634 }
635
rfcomm_sock_setsockopt_old(struct socket * sock,int optname,sockptr_t optval,unsigned int optlen)636 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
637 sockptr_t optval, unsigned int optlen)
638 {
639 struct sock *sk = sock->sk;
640 int err = 0;
641 u32 opt;
642
643 BT_DBG("sk %p", sk);
644
645 lock_sock(sk);
646
647 switch (optname) {
648 case RFCOMM_LM:
649 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
650 if (err)
651 break;
652
653 if (opt & RFCOMM_LM_FIPS) {
654 err = -EINVAL;
655 break;
656 }
657
658 if (opt & RFCOMM_LM_AUTH)
659 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
660 if (opt & RFCOMM_LM_ENCRYPT)
661 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
662 if (opt & RFCOMM_LM_SECURE)
663 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
664
665 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
666 break;
667
668 default:
669 err = -ENOPROTOOPT;
670 break;
671 }
672
673 release_sock(sk);
674 return err;
675 }
676
rfcomm_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)677 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
678 sockptr_t optval, unsigned int optlen)
679 {
680 struct sock *sk = sock->sk;
681 struct bt_security sec;
682 int err = 0;
683 u32 opt;
684
685 BT_DBG("sk %p", sk);
686
687 if (level == SOL_RFCOMM)
688 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
689
690 if (level != SOL_BLUETOOTH)
691 return -ENOPROTOOPT;
692
693 lock_sock(sk);
694
695 switch (optname) {
696 case BT_SECURITY:
697 if (sk->sk_type != SOCK_STREAM) {
698 err = -EINVAL;
699 break;
700 }
701
702 sec.level = BT_SECURITY_LOW;
703
704 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
705 if (err)
706 break;
707
708 if (sec.level > BT_SECURITY_HIGH) {
709 err = -EINVAL;
710 break;
711 }
712
713 rfcomm_pi(sk)->sec_level = sec.level;
714 break;
715
716 case BT_DEFER_SETUP:
717 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
718 err = -EINVAL;
719 break;
720 }
721
722 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
723 if (err)
724 break;
725
726 if (opt)
727 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
728 else
729 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
730
731 break;
732
733 default:
734 err = -ENOPROTOOPT;
735 break;
736 }
737
738 release_sock(sk);
739 return err;
740 }
741
rfcomm_sock_getsockopt_old(struct socket * sock,int optname,sockopt_t * sopt)742 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname,
743 sockopt_t *sopt)
744 {
745 struct sock *sk = sock->sk;
746 struct sock *l2cap_sk;
747 struct l2cap_conn *conn;
748 struct rfcomm_conninfo cinfo;
749 int err = 0;
750 size_t len;
751 u32 opt;
752
753 BT_DBG("sk %p", sk);
754
755 len = sopt->optlen;
756
757 lock_sock(sk);
758
759 switch (optname) {
760 case RFCOMM_LM:
761 switch (rfcomm_pi(sk)->sec_level) {
762 case BT_SECURITY_LOW:
763 opt = RFCOMM_LM_AUTH;
764 break;
765 case BT_SECURITY_MEDIUM:
766 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
767 break;
768 case BT_SECURITY_HIGH:
769 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
770 RFCOMM_LM_SECURE;
771 break;
772 case BT_SECURITY_FIPS:
773 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
774 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
775 break;
776 default:
777 opt = 0;
778 break;
779 }
780
781 if (rfcomm_pi(sk)->role_switch)
782 opt |= RFCOMM_LM_MASTER;
783
784 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
785 sizeof(opt))
786 err = -EFAULT;
787
788 break;
789
790 case RFCOMM_CONNINFO:
791 if (sk->sk_state != BT_CONNECTED &&
792 !rfcomm_pi(sk)->dlc->defer_setup) {
793 err = -ENOTCONN;
794 break;
795 }
796
797 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
798 conn = l2cap_pi(l2cap_sk)->chan->conn;
799
800 memset(&cinfo, 0, sizeof(cinfo));
801 cinfo.hci_handle = conn->hcon->handle;
802 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
803
804 len = min(len, sizeof(cinfo));
805 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len)
806 err = -EFAULT;
807
808 break;
809
810 default:
811 err = -ENOPROTOOPT;
812 break;
813 }
814
815 release_sock(sk);
816 return err;
817 }
818
rfcomm_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * sopt)819 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname,
820 sockopt_t *sopt)
821 {
822 struct sock *sk = sock->sk;
823 struct bt_security sec;
824 int err = 0;
825 size_t len;
826 u32 opt;
827
828 BT_DBG("sk %p", sk);
829
830 if (level == SOL_RFCOMM)
831 return rfcomm_sock_getsockopt_old(sock, optname, sopt);
832
833 if (level != SOL_BLUETOOTH)
834 return -ENOPROTOOPT;
835
836 len = sopt->optlen;
837
838 lock_sock(sk);
839
840 switch (optname) {
841 case BT_SECURITY:
842 if (sk->sk_type != SOCK_STREAM) {
843 err = -EINVAL;
844 break;
845 }
846
847 sec.level = rfcomm_pi(sk)->sec_level;
848 sec.key_size = 0;
849
850 len = min(len, sizeof(sec));
851 if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
852 err = -EFAULT;
853
854 break;
855
856 case BT_DEFER_SETUP:
857 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
858 err = -EINVAL;
859 break;
860 }
861
862 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
863 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
864 sizeof(opt))
865 err = -EFAULT;
866
867 break;
868
869 default:
870 err = -ENOPROTOOPT;
871 break;
872 }
873
874 release_sock(sk);
875 return err;
876 }
877
rfcomm_sock_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)878 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
879 {
880 struct sock *sk __maybe_unused = sock->sk;
881 int err;
882
883 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
884
885 err = bt_sock_ioctl(sock, cmd, arg);
886
887 if (err == -ENOIOCTLCMD) {
888 #ifdef CONFIG_BT_RFCOMM_TTY
889 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
890 #else
891 err = -EOPNOTSUPP;
892 #endif
893 }
894
895 return err;
896 }
897
898 #ifdef CONFIG_COMPAT
rfcomm_sock_compat_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)899 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
900 {
901 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
902 }
903 #endif
904
rfcomm_sock_shutdown(struct socket * sock,int how)905 static int rfcomm_sock_shutdown(struct socket *sock, int how)
906 {
907 struct sock *sk = sock->sk;
908 int err = 0;
909
910 BT_DBG("sock %p, sk %p", sock, sk);
911
912 if (!sk)
913 return 0;
914
915 lock_sock(sk);
916 if (!sk->sk_shutdown) {
917 sk->sk_shutdown = SHUTDOWN_MASK;
918
919 release_sock(sk);
920 __rfcomm_sock_close(sk);
921 lock_sock(sk);
922
923 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
924 !(current->flags & PF_EXITING))
925 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
926 }
927 release_sock(sk);
928 return err;
929 }
930
rfcomm_sock_release(struct socket * sock)931 static int rfcomm_sock_release(struct socket *sock)
932 {
933 struct sock *sk = sock->sk;
934 int err;
935
936 BT_DBG("sock %p, sk %p", sock, sk);
937
938 if (!sk)
939 return 0;
940
941 err = rfcomm_sock_shutdown(sock, 2);
942
943 sock_orphan(sk);
944 rfcomm_sock_kill(sk);
945 return err;
946 }
947
948 /* ---- RFCOMM core layer callbacks ----
949 *
950 * called under rfcomm_lock()
951 */
rfcomm_connect_ind(struct rfcomm_session * s,u8 channel,struct rfcomm_dlc ** d)952 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
953 {
954 struct sock *sk, *parent;
955 bdaddr_t src, dst;
956 bool defer_setup = false;
957 int result = 0;
958
959 BT_DBG("session %p channel %d", s, channel);
960
961 rfcomm_session_getaddr(s, &src, &dst);
962
963 /* Check if we have socket listening on channel */
964 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
965 if (!parent)
966 return 0;
967
968 lock_sock(parent);
969
970 if (parent->sk_state != BT_LISTEN)
971 goto done;
972
973 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags);
974
975 /* Check for backlog size */
976 if (sk_acceptq_is_full(parent)) {
977 BT_DBG("backlog full %d", parent->sk_ack_backlog);
978 goto done;
979 }
980
981 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
982 if (!sk)
983 goto done;
984
985 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
986
987 rfcomm_sock_init(sk, parent);
988 bacpy(&rfcomm_pi(sk)->src, &src);
989 bacpy(&rfcomm_pi(sk)->dst, &dst);
990 rfcomm_pi(sk)->channel = channel;
991
992 sk->sk_state = BT_CONFIG;
993 bt_accept_enqueue(parent, sk, true);
994
995 /* Accept connection and return socket DLC */
996 *d = rfcomm_pi(sk)->dlc;
997 result = 1;
998
999 done:
1000 release_sock(parent);
1001
1002 if (defer_setup)
1003 parent->sk_state_change(parent);
1004
1005 sock_put(parent);
1006
1007 return result;
1008 }
1009
rfcomm_sock_debugfs_show(struct seq_file * f,void * p)1010 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1011 {
1012 struct sock *sk;
1013
1014 read_lock(&rfcomm_sk_list.lock);
1015
1016 sk_for_each(sk, &rfcomm_sk_list.head) {
1017 seq_printf(f, "%pMR %pMR %d %d\n",
1018 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1019 sk->sk_state, rfcomm_pi(sk)->channel);
1020 }
1021
1022 read_unlock(&rfcomm_sk_list.lock);
1023
1024 return 0;
1025 }
1026
1027 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1028
1029 static struct dentry *rfcomm_sock_debugfs;
1030
1031 static const struct proto_ops rfcomm_sock_ops = {
1032 .family = PF_BLUETOOTH,
1033 .owner = THIS_MODULE,
1034 .release = rfcomm_sock_release,
1035 .bind = rfcomm_sock_bind,
1036 .connect = rfcomm_sock_connect,
1037 .listen = rfcomm_sock_listen,
1038 .accept = rfcomm_sock_accept,
1039 .getname = rfcomm_sock_getname,
1040 .sendmsg = rfcomm_sock_sendmsg,
1041 .recvmsg = rfcomm_sock_recvmsg,
1042 .shutdown = rfcomm_sock_shutdown,
1043 .setsockopt = rfcomm_sock_setsockopt,
1044 .getsockopt_iter = rfcomm_sock_getsockopt,
1045 .ioctl = rfcomm_sock_ioctl,
1046 .gettstamp = sock_gettstamp,
1047 .poll = bt_sock_poll,
1048 .socketpair = sock_no_socketpair,
1049 .mmap = sock_no_mmap,
1050 #ifdef CONFIG_COMPAT
1051 .compat_ioctl = rfcomm_sock_compat_ioctl,
1052 #endif
1053 };
1054
1055 static const struct net_proto_family rfcomm_sock_family_ops = {
1056 .family = PF_BLUETOOTH,
1057 .owner = THIS_MODULE,
1058 .create = rfcomm_sock_create
1059 };
1060
rfcomm_init_sockets(void)1061 int __init rfcomm_init_sockets(void)
1062 {
1063 int err;
1064
1065 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1066
1067 err = proto_register(&rfcomm_proto, 0);
1068 if (err < 0)
1069 return err;
1070
1071 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1072 if (err < 0) {
1073 BT_ERR("RFCOMM socket layer registration failed");
1074 goto error;
1075 }
1076
1077 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1078 if (err < 0) {
1079 BT_ERR("Failed to create RFCOMM proc file");
1080 bt_sock_unregister(BTPROTO_RFCOMM);
1081 goto error;
1082 }
1083
1084 BT_INFO("RFCOMM socket layer initialized");
1085
1086 if (IS_ERR_OR_NULL(bt_debugfs))
1087 return 0;
1088
1089 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1090 bt_debugfs, NULL,
1091 &rfcomm_sock_debugfs_fops);
1092
1093 return 0;
1094
1095 error:
1096 proto_unregister(&rfcomm_proto);
1097 return err;
1098 }
1099
rfcomm_cleanup_sockets(void)1100 void __exit rfcomm_cleanup_sockets(void)
1101 {
1102 bt_procfs_cleanup(&init_net, "rfcomm");
1103
1104 debugfs_remove(rfcomm_sock_debugfs);
1105
1106 bt_sock_unregister(BTPROTO_RFCOMM);
1107
1108 proto_unregister(&rfcomm_proto);
1109 }
1110