1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * RFCOMM sockets. 23 */ 24 #include <linux/compat.h> 25 #include <linux/export.h> 26 #include <linux/debugfs.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 static const struct proto_ops rfcomm_sock_ops; 36 37 static struct bt_sock_list rfcomm_sk_list = { 38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 39 }; 40 41 static void rfcomm_sock_close(struct sock *sk); 42 static void rfcomm_sock_kill(struct sock *sk); 43 44 /* ---- DLC callbacks ---- 45 * 46 * called under rfcomm_dlc_lock() 47 */ 48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 49 { 50 struct sock *sk = d->owner; 51 52 if (!sk) { 53 kfree_skb(skb); 54 return; 55 } 56 57 atomic_add(skb->len, &sk->sk_rmem_alloc); 58 skb_queue_tail(&sk->sk_receive_queue, skb); 59 sk->sk_data_ready(sk); 60 61 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 62 rfcomm_dlc_throttle(d); 63 } 64 65 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 66 __must_hold(&d->lock) 67 { 68 struct sock *sk = d->owner, *parent; 69 70 if (!sk) 71 return; 72 73 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 74 75 lock_sock(sk); 76 77 if (err) 78 sk->sk_err = err; 79 80 sk->sk_state = d->state; 81 82 parent = bt_sk(sk)->parent; 83 if (parent) { 84 if (d->state == BT_CLOSED) { 85 sock_set_flag(sk, SOCK_ZAPPED); 86 bt_accept_unlink(sk); 87 } 88 parent->sk_data_ready(parent); 89 } else { 90 if (d->state == BT_CONNECTED) 91 rfcomm_session_getaddr(d->session, 92 &rfcomm_pi(sk)->src, NULL); 93 sk->sk_state_change(sk); 94 } 95 96 release_sock(sk); 97 98 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 99 /* We have to drop DLC lock here, otherwise 100 * rfcomm_sock_destruct() will dead lock. */ 101 rfcomm_dlc_unlock(d); 102 rfcomm_sock_kill(sk); 103 rfcomm_dlc_lock(d); 104 } 105 } 106 107 /* ---- Socket functions ---- */ 108 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 109 { 110 struct sock *sk = NULL; 111 112 sk_for_each(sk, &rfcomm_sk_list.head) { 113 if (rfcomm_pi(sk)->channel != channel) 114 continue; 115 116 if (bacmp(&rfcomm_pi(sk)->src, src)) 117 continue; 118 119 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 120 break; 121 } 122 123 return sk ? sk : NULL; 124 } 125 126 /* Find socket with channel and source bdaddr. 127 * Returns closest match with an extra reference held. 128 */ 129 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 130 { 131 struct sock *sk = NULL, *sk1 = NULL; 132 133 read_lock(&rfcomm_sk_list.lock); 134 135 sk_for_each(sk, &rfcomm_sk_list.head) { 136 if (state && sk->sk_state != state) 137 continue; 138 139 if (rfcomm_pi(sk)->channel == channel) { 140 /* Exact match. */ 141 if (!bacmp(&rfcomm_pi(sk)->src, src)) { 142 sock_hold(sk); 143 break; 144 } 145 146 /* Closest match */ 147 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) { 148 if (sk1) 149 sock_put(sk1); 150 151 sk1 = sk; 152 sock_hold(sk1); 153 } 154 } 155 } 156 157 if (sk && sk1) 158 sock_put(sk1); 159 160 read_unlock(&rfcomm_sk_list.lock); 161 162 return sk ? sk : sk1; 163 } 164 165 static void rfcomm_sock_destruct(struct sock *sk) 166 { 167 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 168 169 BT_DBG("sk %p dlc %p", sk, d); 170 171 skb_queue_purge(&sk->sk_receive_queue); 172 skb_queue_purge(&sk->sk_write_queue); 173 174 rfcomm_dlc_lock(d); 175 rfcomm_pi(sk)->dlc = NULL; 176 177 /* Detach DLC if it's owned by this socket */ 178 if (d->owner == sk) 179 d->owner = NULL; 180 rfcomm_dlc_unlock(d); 181 182 rfcomm_dlc_put(d); 183 } 184 185 static void rfcomm_sock_cleanup_listen(struct sock *parent) 186 { 187 struct sock *sk; 188 189 BT_DBG("parent %p", parent); 190 191 /* Close not yet accepted dlcs */ 192 while ((sk = bt_accept_dequeue(parent, NULL))) { 193 rfcomm_sock_close(sk); 194 rfcomm_sock_kill(sk); 195 /* Drop the reference handed back by bt_accept_dequeue(). */ 196 sock_put(sk); 197 } 198 199 parent->sk_state = BT_CLOSED; 200 sock_set_flag(parent, SOCK_ZAPPED); 201 } 202 203 /* Kill socket (only if zapped and orphan) 204 * Must be called on unlocked socket. 205 */ 206 static void rfcomm_sock_kill(struct sock *sk) 207 { 208 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 209 return; 210 211 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 212 213 /* Kill poor orphan */ 214 bt_sock_unlink(&rfcomm_sk_list, sk); 215 sock_set_flag(sk, SOCK_DEAD); 216 sock_put(sk); 217 } 218 219 static void __rfcomm_sock_close(struct sock *sk) 220 { 221 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 222 223 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 224 225 switch (sk->sk_state) { 226 case BT_LISTEN: 227 rfcomm_sock_cleanup_listen(sk); 228 break; 229 230 case BT_CONNECT: 231 case BT_CONNECT2: 232 case BT_CONFIG: 233 case BT_CONNECTED: 234 rfcomm_dlc_close(d, 0); 235 fallthrough; 236 237 default: 238 sock_set_flag(sk, SOCK_ZAPPED); 239 break; 240 } 241 } 242 243 /* Close socket. 244 * Must be called on unlocked socket. 245 */ 246 static void rfcomm_sock_close(struct sock *sk) 247 { 248 __rfcomm_sock_close(sk); 249 } 250 251 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 252 { 253 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 254 255 BT_DBG("sk %p", sk); 256 257 if (parent) { 258 sk->sk_type = parent->sk_type; 259 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 260 &bt_sk(parent)->flags); 261 262 pi->sec_level = rfcomm_pi(parent)->sec_level; 263 pi->role_switch = rfcomm_pi(parent)->role_switch; 264 265 security_sk_clone(parent, sk); 266 } else { 267 pi->dlc->defer_setup = 0; 268 269 pi->sec_level = BT_SECURITY_LOW; 270 pi->role_switch = 0; 271 } 272 273 pi->dlc->sec_level = pi->sec_level; 274 pi->dlc->role_switch = pi->role_switch; 275 } 276 277 static struct proto rfcomm_proto = { 278 .name = "RFCOMM", 279 .owner = THIS_MODULE, 280 .obj_size = sizeof(struct rfcomm_pinfo) 281 }; 282 283 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, 284 int proto, gfp_t prio, int kern) 285 { 286 struct rfcomm_dlc *d; 287 struct sock *sk; 288 289 d = rfcomm_dlc_alloc(prio); 290 if (!d) 291 return NULL; 292 293 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); 294 if (!sk) { 295 rfcomm_dlc_free(d); 296 return NULL; 297 } 298 299 d->data_ready = rfcomm_sk_data_ready; 300 d->state_change = rfcomm_sk_state_change; 301 302 rfcomm_pi(sk)->dlc = d; 303 d->owner = sk; 304 305 sk->sk_destruct = rfcomm_sock_destruct; 306 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 307 308 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 309 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 310 311 bt_sock_link(&rfcomm_sk_list, sk); 312 313 BT_DBG("sk %p", sk); 314 return sk; 315 } 316 317 static int rfcomm_sock_create(struct net *net, struct socket *sock, 318 int protocol, int kern) 319 { 320 struct sock *sk; 321 322 BT_DBG("sock %p", sock); 323 324 sock->state = SS_UNCONNECTED; 325 326 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 327 return -ESOCKTNOSUPPORT; 328 329 sock->ops = &rfcomm_sock_ops; 330 331 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 332 if (!sk) 333 return -ENOMEM; 334 335 rfcomm_sock_init(sk, NULL); 336 return 0; 337 } 338 339 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len) 340 { 341 struct sockaddr_rc sa; 342 struct sock *sk = sock->sk; 343 int len, err = 0; 344 345 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 346 addr->sa_family != AF_BLUETOOTH) 347 return -EINVAL; 348 349 memset(&sa, 0, sizeof(sa)); 350 len = min_t(unsigned int, sizeof(sa), addr_len); 351 memcpy(&sa, addr, len); 352 353 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 354 355 lock_sock(sk); 356 357 if (sk->sk_state != BT_OPEN) { 358 err = -EBADFD; 359 goto done; 360 } 361 362 if (sk->sk_type != SOCK_STREAM) { 363 err = -EINVAL; 364 goto done; 365 } 366 367 write_lock(&rfcomm_sk_list.lock); 368 369 if (sa.rc_channel && 370 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 371 err = -EADDRINUSE; 372 } else { 373 /* Save source address */ 374 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 375 rfcomm_pi(sk)->channel = sa.rc_channel; 376 sk->sk_state = BT_BOUND; 377 } 378 379 write_unlock(&rfcomm_sk_list.lock); 380 381 done: 382 release_sock(sk); 383 return err; 384 } 385 386 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 387 int alen, int flags) 388 { 389 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 390 struct sock *sk = sock->sk; 391 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 392 int err = 0; 393 394 BT_DBG("sk %p", sk); 395 396 if (alen < sizeof(struct sockaddr_rc) || 397 addr->sa_family != AF_BLUETOOTH) 398 return -EINVAL; 399 400 sock_hold(sk); 401 lock_sock(sk); 402 403 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 404 err = -EBADFD; 405 goto done; 406 } 407 408 if (sk->sk_type != SOCK_STREAM) { 409 err = -EINVAL; 410 goto done; 411 } 412 413 sk->sk_state = BT_CONNECT; 414 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 415 rfcomm_pi(sk)->channel = sa->rc_channel; 416 417 d->sec_level = rfcomm_pi(sk)->sec_level; 418 d->role_switch = rfcomm_pi(sk)->role_switch; 419 420 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ 421 release_sock(sk); 422 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 423 sa->rc_channel); 424 lock_sock(sk); 425 if (!err && !sock_flag(sk, SOCK_ZAPPED)) 426 err = bt_sock_wait_state(sk, BT_CONNECTED, 427 sock_sndtimeo(sk, flags & O_NONBLOCK)); 428 429 done: 430 release_sock(sk); 431 sock_put(sk); 432 return err; 433 } 434 435 static int rfcomm_sock_listen(struct socket *sock, int backlog) 436 { 437 struct sock *sk = sock->sk; 438 int err = 0; 439 440 BT_DBG("sk %p backlog %d", sk, backlog); 441 442 lock_sock(sk); 443 444 if (sk->sk_state != BT_BOUND) { 445 err = -EBADFD; 446 goto done; 447 } 448 449 if (sk->sk_type != SOCK_STREAM) { 450 err = -EINVAL; 451 goto done; 452 } 453 454 if (!rfcomm_pi(sk)->channel) { 455 bdaddr_t *src = &rfcomm_pi(sk)->src; 456 u8 channel; 457 458 err = -EINVAL; 459 460 write_lock(&rfcomm_sk_list.lock); 461 462 for (channel = 1; channel < 31; channel++) 463 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 464 rfcomm_pi(sk)->channel = channel; 465 err = 0; 466 break; 467 } 468 469 write_unlock(&rfcomm_sk_list.lock); 470 471 if (err < 0) 472 goto done; 473 } 474 475 sk->sk_max_ack_backlog = backlog; 476 sk->sk_ack_backlog = 0; 477 sk->sk_state = BT_LISTEN; 478 479 done: 480 release_sock(sk); 481 return err; 482 } 483 484 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, 485 struct proto_accept_arg *arg) 486 { 487 DEFINE_WAIT_FUNC(wait, woken_wake_function); 488 struct sock *sk = sock->sk, *nsk; 489 long timeo; 490 int err = 0; 491 492 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 493 494 if (sk->sk_type != SOCK_STREAM) { 495 err = -EINVAL; 496 goto done; 497 } 498 499 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 500 501 BT_DBG("sk %p timeo %ld", sk, timeo); 502 503 /* Wait for an incoming connection. (wake-one). */ 504 add_wait_queue_exclusive(sk_sleep(sk), &wait); 505 while (1) { 506 if (sk->sk_state != BT_LISTEN) { 507 err = -EBADFD; 508 break; 509 } 510 511 nsk = bt_accept_dequeue(sk, newsock); 512 if (nsk) { 513 /* Drop the bridging ref from bt_accept_dequeue(); 514 * the grafted socket keeps nsk alive from here. 515 */ 516 sock_put(nsk); 517 break; 518 } 519 520 if (!timeo) { 521 err = -EAGAIN; 522 break; 523 } 524 525 if (signal_pending(current)) { 526 err = sock_intr_errno(timeo); 527 break; 528 } 529 530 release_sock(sk); 531 532 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 533 534 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 535 } 536 remove_wait_queue(sk_sleep(sk), &wait); 537 538 if (err) 539 goto done; 540 541 newsock->state = SS_CONNECTED; 542 543 BT_DBG("new socket %p", nsk); 544 545 done: 546 release_sock(sk); 547 return err; 548 } 549 550 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 551 { 552 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 553 struct sock *sk = sock->sk; 554 555 BT_DBG("sock %p, sk %p", sock, sk); 556 557 if (peer && sk->sk_state != BT_CONNECTED && 558 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 559 return -ENOTCONN; 560 561 memset(sa, 0, sizeof(*sa)); 562 sa->rc_family = AF_BLUETOOTH; 563 sa->rc_channel = rfcomm_pi(sk)->channel; 564 if (peer) 565 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 566 else 567 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 568 569 return sizeof(struct sockaddr_rc); 570 } 571 572 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 573 size_t len) 574 { 575 struct sock *sk = sock->sk; 576 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 577 struct sk_buff *skb; 578 int sent; 579 580 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 581 return -ENOTCONN; 582 583 if (msg->msg_flags & MSG_OOB) 584 return -EOPNOTSUPP; 585 586 if (sk->sk_shutdown & SEND_SHUTDOWN) 587 return -EPIPE; 588 589 BT_DBG("sock %p, sk %p", sock, sk); 590 591 lock_sock(sk); 592 593 sent = bt_sock_wait_ready(sk, msg->msg_flags); 594 595 release_sock(sk); 596 597 if (sent) 598 return sent; 599 600 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, 601 RFCOMM_SKB_TAIL_RESERVE); 602 if (IS_ERR(skb)) 603 return PTR_ERR(skb); 604 605 sent = rfcomm_dlc_send(d, skb); 606 if (sent < 0) 607 kfree_skb(skb); 608 609 return sent; 610 } 611 612 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 613 size_t size, int flags) 614 { 615 struct sock *sk = sock->sk; 616 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 617 int len; 618 619 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 620 rfcomm_dlc_accept(d); 621 return 0; 622 } 623 624 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 625 626 lock_sock(sk); 627 if (!(flags & MSG_PEEK) && len > 0) 628 atomic_sub(len, &sk->sk_rmem_alloc); 629 630 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 631 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 632 release_sock(sk); 633 634 return len; 635 } 636 637 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 638 sockptr_t optval, unsigned int optlen) 639 { 640 struct sock *sk = sock->sk; 641 int err = 0; 642 u32 opt; 643 644 BT_DBG("sk %p", sk); 645 646 lock_sock(sk); 647 648 switch (optname) { 649 case RFCOMM_LM: 650 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 651 if (err) 652 break; 653 654 if (opt & RFCOMM_LM_FIPS) { 655 err = -EINVAL; 656 break; 657 } 658 659 if (opt & RFCOMM_LM_AUTH) 660 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 661 if (opt & RFCOMM_LM_ENCRYPT) 662 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 663 if (opt & RFCOMM_LM_SECURE) 664 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 665 666 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 667 break; 668 669 default: 670 err = -ENOPROTOOPT; 671 break; 672 } 673 674 release_sock(sk); 675 return err; 676 } 677 678 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 679 sockptr_t optval, unsigned int optlen) 680 { 681 struct sock *sk = sock->sk; 682 struct bt_security sec; 683 int err = 0; 684 u32 opt; 685 686 BT_DBG("sk %p", sk); 687 688 if (level == SOL_RFCOMM) 689 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 690 691 if (level != SOL_BLUETOOTH) 692 return -ENOPROTOOPT; 693 694 lock_sock(sk); 695 696 switch (optname) { 697 case BT_SECURITY: 698 if (sk->sk_type != SOCK_STREAM) { 699 err = -EINVAL; 700 break; 701 } 702 703 sec.level = BT_SECURITY_LOW; 704 705 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 706 if (err) 707 break; 708 709 if (sec.level > BT_SECURITY_HIGH) { 710 err = -EINVAL; 711 break; 712 } 713 714 rfcomm_pi(sk)->sec_level = sec.level; 715 break; 716 717 case BT_DEFER_SETUP: 718 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 719 err = -EINVAL; 720 break; 721 } 722 723 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 724 if (err) 725 break; 726 727 assign_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags, opt); 728 729 break; 730 731 default: 732 err = -ENOPROTOOPT; 733 break; 734 } 735 736 release_sock(sk); 737 return err; 738 } 739 740 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, 741 sockopt_t *sopt) 742 { 743 struct sock *sk = sock->sk; 744 struct sock *l2cap_sk; 745 struct l2cap_conn *conn; 746 struct rfcomm_conninfo cinfo; 747 int err = 0; 748 size_t len; 749 u32 opt; 750 751 BT_DBG("sk %p", sk); 752 753 len = sopt->optlen; 754 755 lock_sock(sk); 756 757 switch (optname) { 758 case RFCOMM_LM: 759 switch (rfcomm_pi(sk)->sec_level) { 760 case BT_SECURITY_LOW: 761 opt = RFCOMM_LM_AUTH; 762 break; 763 case BT_SECURITY_MEDIUM: 764 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 765 break; 766 case BT_SECURITY_HIGH: 767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 768 RFCOMM_LM_SECURE; 769 break; 770 case BT_SECURITY_FIPS: 771 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 772 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 773 break; 774 default: 775 opt = 0; 776 break; 777 } 778 779 if (rfcomm_pi(sk)->role_switch) 780 opt |= RFCOMM_LM_MASTER; 781 782 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 783 sizeof(opt)) 784 err = -EFAULT; 785 786 break; 787 788 case RFCOMM_CONNINFO: 789 if ((sk->sk_state != BT_CONNECTED && 790 !(sk->sk_state == BT_CONNECT2 && 791 rfcomm_pi(sk)->dlc->defer_setup)) || 792 !rfcomm_pi(sk)->dlc->session) { 793 err = -ENOTCONN; 794 break; 795 } 796 797 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 798 conn = l2cap_pi(l2cap_sk)->chan->conn; 799 800 memset(&cinfo, 0, sizeof(cinfo)); 801 cinfo.hci_handle = conn->hcon->handle; 802 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 803 804 len = min(len, sizeof(cinfo)); 805 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 806 err = -EFAULT; 807 808 break; 809 810 default: 811 err = -ENOPROTOOPT; 812 break; 813 } 814 815 release_sock(sk); 816 return err; 817 } 818 819 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, 820 sockopt_t *sopt) 821 { 822 struct sock *sk = sock->sk; 823 struct bt_security sec; 824 int err = 0; 825 size_t len; 826 u32 opt; 827 828 BT_DBG("sk %p", sk); 829 830 if (level == SOL_RFCOMM) 831 return rfcomm_sock_getsockopt_old(sock, optname, sopt); 832 833 if (level != SOL_BLUETOOTH) 834 return -ENOPROTOOPT; 835 836 len = sopt->optlen; 837 838 lock_sock(sk); 839 840 switch (optname) { 841 case BT_SECURITY: 842 if (sk->sk_type != SOCK_STREAM) { 843 err = -EINVAL; 844 break; 845 } 846 847 sec.level = rfcomm_pi(sk)->sec_level; 848 sec.key_size = 0; 849 850 len = min(len, sizeof(sec)); 851 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 852 err = -EFAULT; 853 854 break; 855 856 case BT_DEFER_SETUP: 857 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 858 err = -EINVAL; 859 break; 860 } 861 862 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 863 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 864 sizeof(opt)) 865 err = -EFAULT; 866 867 break; 868 869 default: 870 err = -ENOPROTOOPT; 871 break; 872 } 873 874 release_sock(sk); 875 return err; 876 } 877 878 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 879 { 880 struct sock *sk __maybe_unused = sock->sk; 881 int err; 882 883 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 884 885 err = bt_sock_ioctl(sock, cmd, arg); 886 887 if (err == -ENOIOCTLCMD) { 888 #ifdef CONFIG_BT_RFCOMM_TTY 889 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 890 #else 891 err = -EOPNOTSUPP; 892 #endif 893 } 894 895 return err; 896 } 897 898 #ifdef CONFIG_COMPAT 899 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 900 { 901 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 902 } 903 #endif 904 905 static int rfcomm_sock_shutdown(struct socket *sock, int how) 906 { 907 struct sock *sk = sock->sk; 908 bool cleanup_listen = false; 909 int err = 0; 910 911 BT_DBG("sock %p, sk %p", sock, sk); 912 913 if (!sk) 914 return 0; 915 916 lock_sock(sk); 917 if (!sk->sk_shutdown) { 918 sk->sk_shutdown = SHUTDOWN_MASK; 919 if (sk->sk_state == BT_LISTEN) { 920 /* Block new children before cleaning up without sk lock. */ 921 sk->sk_state = BT_CLOSED; 922 cleanup_listen = true; 923 } 924 925 release_sock(sk); 926 if (cleanup_listen) 927 rfcomm_sock_cleanup_listen(sk); 928 else 929 __rfcomm_sock_close(sk); 930 lock_sock(sk); 931 932 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 933 !(current->flags & PF_EXITING)) 934 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 935 } 936 release_sock(sk); 937 return err; 938 } 939 940 static int rfcomm_sock_release(struct socket *sock) 941 { 942 struct sock *sk = sock->sk; 943 int err; 944 945 BT_DBG("sock %p, sk %p", sock, sk); 946 947 if (!sk) 948 return 0; 949 950 err = rfcomm_sock_shutdown(sock, 2); 951 952 sock_orphan(sk); 953 rfcomm_sock_kill(sk); 954 return err; 955 } 956 957 /* ---- RFCOMM core layer callbacks ---- 958 * 959 * called under rfcomm_lock() 960 */ 961 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 962 { 963 struct sock *sk, *parent; 964 bdaddr_t src, dst; 965 bool defer_setup = false; 966 int result = 0; 967 968 BT_DBG("session %p channel %d", s, channel); 969 970 rfcomm_session_getaddr(s, &src, &dst); 971 972 /* Check if we have socket listening on channel */ 973 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 974 if (!parent) 975 return 0; 976 977 lock_sock(parent); 978 979 if (parent->sk_state != BT_LISTEN) 980 goto done; 981 982 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags); 983 984 /* Check for backlog size */ 985 if (sk_acceptq_is_full(parent)) { 986 BT_DBG("backlog full %d", parent->sk_ack_backlog); 987 goto done; 988 } 989 990 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 991 if (!sk) 992 goto done; 993 994 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 995 996 rfcomm_sock_init(sk, parent); 997 bacpy(&rfcomm_pi(sk)->src, &src); 998 bacpy(&rfcomm_pi(sk)->dst, &dst); 999 rfcomm_pi(sk)->channel = channel; 1000 1001 sk->sk_state = BT_CONFIG; 1002 bt_accept_enqueue(parent, sk, true); 1003 1004 /* Accept connection and return socket DLC */ 1005 *d = rfcomm_pi(sk)->dlc; 1006 result = 1; 1007 1008 done: 1009 release_sock(parent); 1010 1011 if (defer_setup) 1012 parent->sk_state_change(parent); 1013 1014 sock_put(parent); 1015 1016 return result; 1017 } 1018 1019 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1020 { 1021 struct sock *sk; 1022 1023 read_lock(&rfcomm_sk_list.lock); 1024 1025 sk_for_each(sk, &rfcomm_sk_list.head) { 1026 seq_printf(f, "%pMR %pMR %d %d\n", 1027 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1028 sk->sk_state, rfcomm_pi(sk)->channel); 1029 } 1030 1031 read_unlock(&rfcomm_sk_list.lock); 1032 1033 return 0; 1034 } 1035 1036 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs); 1037 1038 static struct dentry *rfcomm_sock_debugfs; 1039 1040 static const struct proto_ops rfcomm_sock_ops = { 1041 .family = PF_BLUETOOTH, 1042 .owner = THIS_MODULE, 1043 .release = rfcomm_sock_release, 1044 .bind = rfcomm_sock_bind, 1045 .connect = rfcomm_sock_connect, 1046 .listen = rfcomm_sock_listen, 1047 .accept = rfcomm_sock_accept, 1048 .getname = rfcomm_sock_getname, 1049 .sendmsg = rfcomm_sock_sendmsg, 1050 .recvmsg = rfcomm_sock_recvmsg, 1051 .shutdown = rfcomm_sock_shutdown, 1052 .setsockopt = rfcomm_sock_setsockopt, 1053 .getsockopt_iter = rfcomm_sock_getsockopt, 1054 .ioctl = rfcomm_sock_ioctl, 1055 .gettstamp = sock_gettstamp, 1056 .poll = bt_sock_poll, 1057 .socketpair = sock_no_socketpair, 1058 .mmap = sock_no_mmap, 1059 #ifdef CONFIG_COMPAT 1060 .compat_ioctl = rfcomm_sock_compat_ioctl, 1061 #endif 1062 }; 1063 1064 static const struct net_proto_family rfcomm_sock_family_ops = { 1065 .family = PF_BLUETOOTH, 1066 .owner = THIS_MODULE, 1067 .create = rfcomm_sock_create 1068 }; 1069 1070 int __init rfcomm_init_sockets(void) 1071 { 1072 int err; 1073 1074 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1075 1076 err = proto_register(&rfcomm_proto, 0); 1077 if (err < 0) 1078 return err; 1079 1080 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1081 if (err < 0) { 1082 BT_ERR("RFCOMM socket layer registration failed"); 1083 goto error; 1084 } 1085 1086 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1087 if (err < 0) { 1088 BT_ERR("Failed to create RFCOMM proc file"); 1089 bt_sock_unregister(BTPROTO_RFCOMM); 1090 goto error; 1091 } 1092 1093 BT_INFO("RFCOMM socket layer initialized"); 1094 1095 if (IS_ERR_OR_NULL(bt_debugfs)) 1096 return 0; 1097 1098 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1099 bt_debugfs, NULL, 1100 &rfcomm_sock_debugfs_fops); 1101 1102 return 0; 1103 1104 error: 1105 proto_unregister(&rfcomm_proto); 1106 return err; 1107 } 1108 1109 void __exit rfcomm_cleanup_sockets(void) 1110 { 1111 bt_procfs_cleanup(&init_net, "rfcomm"); 1112 1113 debugfs_remove(rfcomm_sock_debugfs); 1114 1115 bt_sock_unregister(BTPROTO_RFCOMM); 1116 1117 proto_unregister(&rfcomm_proto); 1118 } 1119