1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
6
7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15
16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
18 SOFTWARE IS DISCLAIMED.
19 */
20
21 /*
22 * RFCOMM sockets.
23 */
24 #include <linux/compat.h>
25 #include <linux/export.h>
26 #include <linux/debugfs.h>
27 #include <linux/sched/signal.h>
28 #include <linux/uio.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33 #include <net/bluetooth/rfcomm.h>
34
35 static const struct proto_ops rfcomm_sock_ops;
36
37 static struct bt_sock_list rfcomm_sk_list = {
38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
39 };
40
41 static void rfcomm_sock_close(struct sock *sk);
42 static void rfcomm_sock_kill(struct sock *sk);
43
44 /* ---- DLC callbacks ----
45 *
46 * called under rfcomm_dlc_lock()
47 */
rfcomm_sk_data_ready(struct rfcomm_dlc * d,struct sk_buff * skb)48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
49 {
50 struct sock *sk = d->owner;
51 if (!sk)
52 return;
53
54 atomic_add(skb->len, &sk->sk_rmem_alloc);
55 skb_queue_tail(&sk->sk_receive_queue, skb);
56 sk->sk_data_ready(sk);
57
58 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
59 rfcomm_dlc_throttle(d);
60 }
61
rfcomm_sk_state_change(struct rfcomm_dlc * d,int err)62 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
63 __must_hold(&d->lock)
64 {
65 struct sock *sk = d->owner, *parent;
66
67 if (!sk)
68 return;
69
70 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
71
72 lock_sock(sk);
73
74 if (err)
75 sk->sk_err = err;
76
77 sk->sk_state = d->state;
78
79 parent = bt_sk(sk)->parent;
80 if (parent) {
81 if (d->state == BT_CLOSED) {
82 sock_set_flag(sk, SOCK_ZAPPED);
83 bt_accept_unlink(sk);
84 }
85 parent->sk_data_ready(parent);
86 } else {
87 if (d->state == BT_CONNECTED)
88 rfcomm_session_getaddr(d->session,
89 &rfcomm_pi(sk)->src, NULL);
90 sk->sk_state_change(sk);
91 }
92
93 release_sock(sk);
94
95 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
96 /* We have to drop DLC lock here, otherwise
97 * rfcomm_sock_destruct() will dead lock. */
98 rfcomm_dlc_unlock(d);
99 rfcomm_sock_kill(sk);
100 rfcomm_dlc_lock(d);
101 }
102 }
103
104 /* ---- Socket functions ---- */
__rfcomm_get_listen_sock_by_addr(u8 channel,bdaddr_t * src)105 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
106 {
107 struct sock *sk = NULL;
108
109 sk_for_each(sk, &rfcomm_sk_list.head) {
110 if (rfcomm_pi(sk)->channel != channel)
111 continue;
112
113 if (bacmp(&rfcomm_pi(sk)->src, src))
114 continue;
115
116 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
117 break;
118 }
119
120 return sk ? sk : NULL;
121 }
122
123 /* Find socket with channel and source bdaddr.
124 * Returns closest match with an extra reference held.
125 */
rfcomm_get_sock_by_channel(int state,u8 channel,bdaddr_t * src)126 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
127 {
128 struct sock *sk = NULL, *sk1 = NULL;
129
130 read_lock(&rfcomm_sk_list.lock);
131
132 sk_for_each(sk, &rfcomm_sk_list.head) {
133 if (state && sk->sk_state != state)
134 continue;
135
136 if (rfcomm_pi(sk)->channel == channel) {
137 /* Exact match. */
138 if (!bacmp(&rfcomm_pi(sk)->src, src)) {
139 sock_hold(sk);
140 break;
141 }
142
143 /* Closest match */
144 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) {
145 if (sk1)
146 sock_put(sk1);
147
148 sk1 = sk;
149 sock_hold(sk1);
150 }
151 }
152 }
153
154 if (sk && sk1)
155 sock_put(sk1);
156
157 read_unlock(&rfcomm_sk_list.lock);
158
159 return sk ? sk : sk1;
160 }
161
rfcomm_sock_destruct(struct sock * sk)162 static void rfcomm_sock_destruct(struct sock *sk)
163 {
164 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
165
166 BT_DBG("sk %p dlc %p", sk, d);
167
168 skb_queue_purge(&sk->sk_receive_queue);
169 skb_queue_purge(&sk->sk_write_queue);
170
171 rfcomm_dlc_lock(d);
172 rfcomm_pi(sk)->dlc = NULL;
173
174 /* Detach DLC if it's owned by this socket */
175 if (d->owner == sk)
176 d->owner = NULL;
177 rfcomm_dlc_unlock(d);
178
179 rfcomm_dlc_put(d);
180 }
181
rfcomm_sock_cleanup_listen(struct sock * parent)182 static void rfcomm_sock_cleanup_listen(struct sock *parent)
183 {
184 struct sock *sk;
185
186 BT_DBG("parent %p", parent);
187
188 /* Close not yet accepted dlcs */
189 while ((sk = bt_accept_dequeue(parent, NULL))) {
190 rfcomm_sock_close(sk);
191 rfcomm_sock_kill(sk);
192 /* Drop the reference handed back by bt_accept_dequeue(). */
193 sock_put(sk);
194 }
195
196 parent->sk_state = BT_CLOSED;
197 sock_set_flag(parent, SOCK_ZAPPED);
198 }
199
200 /* Kill socket (only if zapped and orphan)
201 * Must be called on unlocked socket.
202 */
rfcomm_sock_kill(struct sock * sk)203 static void rfcomm_sock_kill(struct sock *sk)
204 {
205 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
206 return;
207
208 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
209
210 /* Kill poor orphan */
211 bt_sock_unlink(&rfcomm_sk_list, sk);
212 sock_set_flag(sk, SOCK_DEAD);
213 sock_put(sk);
214 }
215
__rfcomm_sock_close(struct sock * sk)216 static void __rfcomm_sock_close(struct sock *sk)
217 {
218 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
219
220 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
221
222 switch (sk->sk_state) {
223 case BT_LISTEN:
224 rfcomm_sock_cleanup_listen(sk);
225 break;
226
227 case BT_CONNECT:
228 case BT_CONNECT2:
229 case BT_CONFIG:
230 case BT_CONNECTED:
231 rfcomm_dlc_close(d, 0);
232 fallthrough;
233
234 default:
235 sock_set_flag(sk, SOCK_ZAPPED);
236 break;
237 }
238 }
239
240 /* Close socket.
241 * Must be called on unlocked socket.
242 */
rfcomm_sock_close(struct sock * sk)243 static void rfcomm_sock_close(struct sock *sk)
244 {
245 __rfcomm_sock_close(sk);
246 }
247
rfcomm_sock_init(struct sock * sk,struct sock * parent)248 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
249 {
250 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
251
252 BT_DBG("sk %p", sk);
253
254 if (parent) {
255 sk->sk_type = parent->sk_type;
256 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
257 &bt_sk(parent)->flags);
258
259 pi->sec_level = rfcomm_pi(parent)->sec_level;
260 pi->role_switch = rfcomm_pi(parent)->role_switch;
261
262 security_sk_clone(parent, sk);
263 } else {
264 pi->dlc->defer_setup = 0;
265
266 pi->sec_level = BT_SECURITY_LOW;
267 pi->role_switch = 0;
268 }
269
270 pi->dlc->sec_level = pi->sec_level;
271 pi->dlc->role_switch = pi->role_switch;
272 }
273
274 static struct proto rfcomm_proto = {
275 .name = "RFCOMM",
276 .owner = THIS_MODULE,
277 .obj_size = sizeof(struct rfcomm_pinfo)
278 };
279
rfcomm_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)280 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,
281 int proto, gfp_t prio, int kern)
282 {
283 struct rfcomm_dlc *d;
284 struct sock *sk;
285
286 d = rfcomm_dlc_alloc(prio);
287 if (!d)
288 return NULL;
289
290 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
291 if (!sk) {
292 rfcomm_dlc_free(d);
293 return NULL;
294 }
295
296 d->data_ready = rfcomm_sk_data_ready;
297 d->state_change = rfcomm_sk_state_change;
298
299 rfcomm_pi(sk)->dlc = d;
300 d->owner = sk;
301
302 sk->sk_destruct = rfcomm_sock_destruct;
303 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
304
305 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
306 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
307
308 bt_sock_link(&rfcomm_sk_list, sk);
309
310 BT_DBG("sk %p", sk);
311 return sk;
312 }
313
rfcomm_sock_create(struct net * net,struct socket * sock,int protocol,int kern)314 static int rfcomm_sock_create(struct net *net, struct socket *sock,
315 int protocol, int kern)
316 {
317 struct sock *sk;
318
319 BT_DBG("sock %p", sock);
320
321 sock->state = SS_UNCONNECTED;
322
323 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
324 return -ESOCKTNOSUPPORT;
325
326 sock->ops = &rfcomm_sock_ops;
327
328 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
329 if (!sk)
330 return -ENOMEM;
331
332 rfcomm_sock_init(sk, NULL);
333 return 0;
334 }
335
rfcomm_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int addr_len)336 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
337 {
338 struct sockaddr_rc sa;
339 struct sock *sk = sock->sk;
340 int len, err = 0;
341
342 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
343 addr->sa_family != AF_BLUETOOTH)
344 return -EINVAL;
345
346 memset(&sa, 0, sizeof(sa));
347 len = min_t(unsigned int, sizeof(sa), addr_len);
348 memcpy(&sa, addr, len);
349
350 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
351
352 lock_sock(sk);
353
354 if (sk->sk_state != BT_OPEN) {
355 err = -EBADFD;
356 goto done;
357 }
358
359 if (sk->sk_type != SOCK_STREAM) {
360 err = -EINVAL;
361 goto done;
362 }
363
364 write_lock(&rfcomm_sk_list.lock);
365
366 if (sa.rc_channel &&
367 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
368 err = -EADDRINUSE;
369 } else {
370 /* Save source address */
371 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
372 rfcomm_pi(sk)->channel = sa.rc_channel;
373 sk->sk_state = BT_BOUND;
374 }
375
376 write_unlock(&rfcomm_sk_list.lock);
377
378 done:
379 release_sock(sk);
380 return err;
381 }
382
rfcomm_sock_connect(struct socket * sock,struct sockaddr_unsized * addr,int alen,int flags)383 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
384 int alen, int flags)
385 {
386 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
387 struct sock *sk = sock->sk;
388 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
389 int err = 0;
390
391 BT_DBG("sk %p", sk);
392
393 if (alen < sizeof(struct sockaddr_rc) ||
394 addr->sa_family != AF_BLUETOOTH)
395 return -EINVAL;
396
397 sock_hold(sk);
398 lock_sock(sk);
399
400 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
401 err = -EBADFD;
402 goto done;
403 }
404
405 if (sk->sk_type != SOCK_STREAM) {
406 err = -EINVAL;
407 goto done;
408 }
409
410 sk->sk_state = BT_CONNECT;
411 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
412 rfcomm_pi(sk)->channel = sa->rc_channel;
413
414 d->sec_level = rfcomm_pi(sk)->sec_level;
415 d->role_switch = rfcomm_pi(sk)->role_switch;
416
417 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */
418 release_sock(sk);
419 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
420 sa->rc_channel);
421 lock_sock(sk);
422 if (!err && !sock_flag(sk, SOCK_ZAPPED))
423 err = bt_sock_wait_state(sk, BT_CONNECTED,
424 sock_sndtimeo(sk, flags & O_NONBLOCK));
425
426 done:
427 release_sock(sk);
428 sock_put(sk);
429 return err;
430 }
431
rfcomm_sock_listen(struct socket * sock,int backlog)432 static int rfcomm_sock_listen(struct socket *sock, int backlog)
433 {
434 struct sock *sk = sock->sk;
435 int err = 0;
436
437 BT_DBG("sk %p backlog %d", sk, backlog);
438
439 lock_sock(sk);
440
441 if (sk->sk_state != BT_BOUND) {
442 err = -EBADFD;
443 goto done;
444 }
445
446 if (sk->sk_type != SOCK_STREAM) {
447 err = -EINVAL;
448 goto done;
449 }
450
451 if (!rfcomm_pi(sk)->channel) {
452 bdaddr_t *src = &rfcomm_pi(sk)->src;
453 u8 channel;
454
455 err = -EINVAL;
456
457 write_lock(&rfcomm_sk_list.lock);
458
459 for (channel = 1; channel < 31; channel++)
460 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
461 rfcomm_pi(sk)->channel = channel;
462 err = 0;
463 break;
464 }
465
466 write_unlock(&rfcomm_sk_list.lock);
467
468 if (err < 0)
469 goto done;
470 }
471
472 sk->sk_max_ack_backlog = backlog;
473 sk->sk_ack_backlog = 0;
474 sk->sk_state = BT_LISTEN;
475
476 done:
477 release_sock(sk);
478 return err;
479 }
480
rfcomm_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)481 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock,
482 struct proto_accept_arg *arg)
483 {
484 DEFINE_WAIT_FUNC(wait, woken_wake_function);
485 struct sock *sk = sock->sk, *nsk;
486 long timeo;
487 int err = 0;
488
489 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
490
491 if (sk->sk_type != SOCK_STREAM) {
492 err = -EINVAL;
493 goto done;
494 }
495
496 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
497
498 BT_DBG("sk %p timeo %ld", sk, timeo);
499
500 /* Wait for an incoming connection. (wake-one). */
501 add_wait_queue_exclusive(sk_sleep(sk), &wait);
502 while (1) {
503 if (sk->sk_state != BT_LISTEN) {
504 err = -EBADFD;
505 break;
506 }
507
508 nsk = bt_accept_dequeue(sk, newsock);
509 if (nsk) {
510 /* Drop the bridging ref from bt_accept_dequeue();
511 * the grafted socket keeps nsk alive from here.
512 */
513 sock_put(nsk);
514 break;
515 }
516
517 if (!timeo) {
518 err = -EAGAIN;
519 break;
520 }
521
522 if (signal_pending(current)) {
523 err = sock_intr_errno(timeo);
524 break;
525 }
526
527 release_sock(sk);
528
529 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
530
531 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
532 }
533 remove_wait_queue(sk_sleep(sk), &wait);
534
535 if (err)
536 goto done;
537
538 newsock->state = SS_CONNECTED;
539
540 BT_DBG("new socket %p", nsk);
541
542 done:
543 release_sock(sk);
544 return err;
545 }
546
rfcomm_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)547 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
548 {
549 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
550 struct sock *sk = sock->sk;
551
552 BT_DBG("sock %p, sk %p", sock, sk);
553
554 if (peer && sk->sk_state != BT_CONNECTED &&
555 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
556 return -ENOTCONN;
557
558 memset(sa, 0, sizeof(*sa));
559 sa->rc_family = AF_BLUETOOTH;
560 sa->rc_channel = rfcomm_pi(sk)->channel;
561 if (peer)
562 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
563 else
564 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
565
566 return sizeof(struct sockaddr_rc);
567 }
568
rfcomm_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)569 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
570 size_t len)
571 {
572 struct sock *sk = sock->sk;
573 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
574 struct sk_buff *skb;
575 int sent;
576
577 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
578 return -ENOTCONN;
579
580 if (msg->msg_flags & MSG_OOB)
581 return -EOPNOTSUPP;
582
583 if (sk->sk_shutdown & SEND_SHUTDOWN)
584 return -EPIPE;
585
586 BT_DBG("sock %p, sk %p", sock, sk);
587
588 lock_sock(sk);
589
590 sent = bt_sock_wait_ready(sk, msg->msg_flags);
591
592 release_sock(sk);
593
594 if (sent)
595 return sent;
596
597 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
598 RFCOMM_SKB_TAIL_RESERVE);
599 if (IS_ERR(skb))
600 return PTR_ERR(skb);
601
602 sent = rfcomm_dlc_send(d, skb);
603 if (sent < 0)
604 kfree_skb(skb);
605
606 return sent;
607 }
608
rfcomm_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t size,int flags)609 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
610 size_t size, int flags)
611 {
612 struct sock *sk = sock->sk;
613 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
614 int len;
615
616 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
617 rfcomm_dlc_accept(d);
618 return 0;
619 }
620
621 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
622
623 lock_sock(sk);
624 if (!(flags & MSG_PEEK) && len > 0)
625 atomic_sub(len, &sk->sk_rmem_alloc);
626
627 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
628 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
629 release_sock(sk);
630
631 return len;
632 }
633
rfcomm_sock_setsockopt_old(struct socket * sock,int optname,sockptr_t optval,unsigned int optlen)634 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
635 sockptr_t optval, unsigned int optlen)
636 {
637 struct sock *sk = sock->sk;
638 int err = 0;
639 u32 opt;
640
641 BT_DBG("sk %p", sk);
642
643 lock_sock(sk);
644
645 switch (optname) {
646 case RFCOMM_LM:
647 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
648 if (err)
649 break;
650
651 if (opt & RFCOMM_LM_FIPS) {
652 err = -EINVAL;
653 break;
654 }
655
656 if (opt & RFCOMM_LM_AUTH)
657 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
658 if (opt & RFCOMM_LM_ENCRYPT)
659 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
660 if (opt & RFCOMM_LM_SECURE)
661 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
662
663 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
664 break;
665
666 default:
667 err = -ENOPROTOOPT;
668 break;
669 }
670
671 release_sock(sk);
672 return err;
673 }
674
rfcomm_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)675 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
676 sockptr_t optval, unsigned int optlen)
677 {
678 struct sock *sk = sock->sk;
679 struct bt_security sec;
680 int err = 0;
681 u32 opt;
682
683 BT_DBG("sk %p", sk);
684
685 if (level == SOL_RFCOMM)
686 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
687
688 if (level != SOL_BLUETOOTH)
689 return -ENOPROTOOPT;
690
691 lock_sock(sk);
692
693 switch (optname) {
694 case BT_SECURITY:
695 if (sk->sk_type != SOCK_STREAM) {
696 err = -EINVAL;
697 break;
698 }
699
700 sec.level = BT_SECURITY_LOW;
701
702 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
703 if (err)
704 break;
705
706 if (sec.level > BT_SECURITY_HIGH) {
707 err = -EINVAL;
708 break;
709 }
710
711 rfcomm_pi(sk)->sec_level = sec.level;
712 break;
713
714 case BT_DEFER_SETUP:
715 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
716 err = -EINVAL;
717 break;
718 }
719
720 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
721 if (err)
722 break;
723
724 if (opt)
725 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
726 else
727 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
728
729 break;
730
731 default:
732 err = -ENOPROTOOPT;
733 break;
734 }
735
736 release_sock(sk);
737 return err;
738 }
739
rfcomm_sock_getsockopt_old(struct socket * sock,int optname,sockopt_t * sopt)740 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname,
741 sockopt_t *sopt)
742 {
743 struct sock *sk = sock->sk;
744 struct sock *l2cap_sk;
745 struct l2cap_conn *conn;
746 struct rfcomm_conninfo cinfo;
747 int err = 0;
748 size_t len;
749 u32 opt;
750
751 BT_DBG("sk %p", sk);
752
753 len = sopt->optlen;
754
755 lock_sock(sk);
756
757 switch (optname) {
758 case RFCOMM_LM:
759 switch (rfcomm_pi(sk)->sec_level) {
760 case BT_SECURITY_LOW:
761 opt = RFCOMM_LM_AUTH;
762 break;
763 case BT_SECURITY_MEDIUM:
764 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
765 break;
766 case BT_SECURITY_HIGH:
767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
768 RFCOMM_LM_SECURE;
769 break;
770 case BT_SECURITY_FIPS:
771 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
772 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
773 break;
774 default:
775 opt = 0;
776 break;
777 }
778
779 if (rfcomm_pi(sk)->role_switch)
780 opt |= RFCOMM_LM_MASTER;
781
782 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
783 sizeof(opt))
784 err = -EFAULT;
785
786 break;
787
788 case RFCOMM_CONNINFO:
789 if (sk->sk_state != BT_CONNECTED &&
790 !rfcomm_pi(sk)->dlc->defer_setup) {
791 err = -ENOTCONN;
792 break;
793 }
794
795 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
796 conn = l2cap_pi(l2cap_sk)->chan->conn;
797
798 memset(&cinfo, 0, sizeof(cinfo));
799 cinfo.hci_handle = conn->hcon->handle;
800 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
801
802 len = min(len, sizeof(cinfo));
803 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len)
804 err = -EFAULT;
805
806 break;
807
808 default:
809 err = -ENOPROTOOPT;
810 break;
811 }
812
813 release_sock(sk);
814 return err;
815 }
816
rfcomm_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * sopt)817 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname,
818 sockopt_t *sopt)
819 {
820 struct sock *sk = sock->sk;
821 struct bt_security sec;
822 int err = 0;
823 size_t len;
824 u32 opt;
825
826 BT_DBG("sk %p", sk);
827
828 if (level == SOL_RFCOMM)
829 return rfcomm_sock_getsockopt_old(sock, optname, sopt);
830
831 if (level != SOL_BLUETOOTH)
832 return -ENOPROTOOPT;
833
834 len = sopt->optlen;
835
836 lock_sock(sk);
837
838 switch (optname) {
839 case BT_SECURITY:
840 if (sk->sk_type != SOCK_STREAM) {
841 err = -EINVAL;
842 break;
843 }
844
845 sec.level = rfcomm_pi(sk)->sec_level;
846 sec.key_size = 0;
847
848 len = min(len, sizeof(sec));
849 if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
850 err = -EFAULT;
851
852 break;
853
854 case BT_DEFER_SETUP:
855 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
856 err = -EINVAL;
857 break;
858 }
859
860 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
861 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
862 sizeof(opt))
863 err = -EFAULT;
864
865 break;
866
867 default:
868 err = -ENOPROTOOPT;
869 break;
870 }
871
872 release_sock(sk);
873 return err;
874 }
875
rfcomm_sock_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)876 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
877 {
878 struct sock *sk __maybe_unused = sock->sk;
879 int err;
880
881 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
882
883 err = bt_sock_ioctl(sock, cmd, arg);
884
885 if (err == -ENOIOCTLCMD) {
886 #ifdef CONFIG_BT_RFCOMM_TTY
887 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
888 #else
889 err = -EOPNOTSUPP;
890 #endif
891 }
892
893 return err;
894 }
895
896 #ifdef CONFIG_COMPAT
rfcomm_sock_compat_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)897 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
898 {
899 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
900 }
901 #endif
902
rfcomm_sock_shutdown(struct socket * sock,int how)903 static int rfcomm_sock_shutdown(struct socket *sock, int how)
904 {
905 struct sock *sk = sock->sk;
906 bool cleanup_listen = false;
907 int err = 0;
908
909 BT_DBG("sock %p, sk %p", sock, sk);
910
911 if (!sk)
912 return 0;
913
914 lock_sock(sk);
915 if (!sk->sk_shutdown) {
916 sk->sk_shutdown = SHUTDOWN_MASK;
917 if (sk->sk_state == BT_LISTEN) {
918 /* Block new children before cleaning up without sk lock. */
919 sk->sk_state = BT_CLOSED;
920 cleanup_listen = true;
921 }
922
923 release_sock(sk);
924 if (cleanup_listen)
925 rfcomm_sock_cleanup_listen(sk);
926 else
927 __rfcomm_sock_close(sk);
928 lock_sock(sk);
929
930 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
931 !(current->flags & PF_EXITING))
932 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
933 }
934 release_sock(sk);
935 return err;
936 }
937
rfcomm_sock_release(struct socket * sock)938 static int rfcomm_sock_release(struct socket *sock)
939 {
940 struct sock *sk = sock->sk;
941 int err;
942
943 BT_DBG("sock %p, sk %p", sock, sk);
944
945 if (!sk)
946 return 0;
947
948 err = rfcomm_sock_shutdown(sock, 2);
949
950 sock_orphan(sk);
951 rfcomm_sock_kill(sk);
952 return err;
953 }
954
955 /* ---- RFCOMM core layer callbacks ----
956 *
957 * called under rfcomm_lock()
958 */
rfcomm_connect_ind(struct rfcomm_session * s,u8 channel,struct rfcomm_dlc ** d)959 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
960 {
961 struct sock *sk, *parent;
962 bdaddr_t src, dst;
963 bool defer_setup = false;
964 int result = 0;
965
966 BT_DBG("session %p channel %d", s, channel);
967
968 rfcomm_session_getaddr(s, &src, &dst);
969
970 /* Check if we have socket listening on channel */
971 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
972 if (!parent)
973 return 0;
974
975 lock_sock(parent);
976
977 if (parent->sk_state != BT_LISTEN)
978 goto done;
979
980 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags);
981
982 /* Check for backlog size */
983 if (sk_acceptq_is_full(parent)) {
984 BT_DBG("backlog full %d", parent->sk_ack_backlog);
985 goto done;
986 }
987
988 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
989 if (!sk)
990 goto done;
991
992 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
993
994 rfcomm_sock_init(sk, parent);
995 bacpy(&rfcomm_pi(sk)->src, &src);
996 bacpy(&rfcomm_pi(sk)->dst, &dst);
997 rfcomm_pi(sk)->channel = channel;
998
999 sk->sk_state = BT_CONFIG;
1000 bt_accept_enqueue(parent, sk, true);
1001
1002 /* Accept connection and return socket DLC */
1003 *d = rfcomm_pi(sk)->dlc;
1004 result = 1;
1005
1006 done:
1007 release_sock(parent);
1008
1009 if (defer_setup)
1010 parent->sk_state_change(parent);
1011
1012 sock_put(parent);
1013
1014 return result;
1015 }
1016
rfcomm_sock_debugfs_show(struct seq_file * f,void * p)1017 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1018 {
1019 struct sock *sk;
1020
1021 read_lock(&rfcomm_sk_list.lock);
1022
1023 sk_for_each(sk, &rfcomm_sk_list.head) {
1024 seq_printf(f, "%pMR %pMR %d %d\n",
1025 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1026 sk->sk_state, rfcomm_pi(sk)->channel);
1027 }
1028
1029 read_unlock(&rfcomm_sk_list.lock);
1030
1031 return 0;
1032 }
1033
1034 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1035
1036 static struct dentry *rfcomm_sock_debugfs;
1037
1038 static const struct proto_ops rfcomm_sock_ops = {
1039 .family = PF_BLUETOOTH,
1040 .owner = THIS_MODULE,
1041 .release = rfcomm_sock_release,
1042 .bind = rfcomm_sock_bind,
1043 .connect = rfcomm_sock_connect,
1044 .listen = rfcomm_sock_listen,
1045 .accept = rfcomm_sock_accept,
1046 .getname = rfcomm_sock_getname,
1047 .sendmsg = rfcomm_sock_sendmsg,
1048 .recvmsg = rfcomm_sock_recvmsg,
1049 .shutdown = rfcomm_sock_shutdown,
1050 .setsockopt = rfcomm_sock_setsockopt,
1051 .getsockopt_iter = rfcomm_sock_getsockopt,
1052 .ioctl = rfcomm_sock_ioctl,
1053 .gettstamp = sock_gettstamp,
1054 .poll = bt_sock_poll,
1055 .socketpair = sock_no_socketpair,
1056 .mmap = sock_no_mmap,
1057 #ifdef CONFIG_COMPAT
1058 .compat_ioctl = rfcomm_sock_compat_ioctl,
1059 #endif
1060 };
1061
1062 static const struct net_proto_family rfcomm_sock_family_ops = {
1063 .family = PF_BLUETOOTH,
1064 .owner = THIS_MODULE,
1065 .create = rfcomm_sock_create
1066 };
1067
rfcomm_init_sockets(void)1068 int __init rfcomm_init_sockets(void)
1069 {
1070 int err;
1071
1072 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1073
1074 err = proto_register(&rfcomm_proto, 0);
1075 if (err < 0)
1076 return err;
1077
1078 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1079 if (err < 0) {
1080 BT_ERR("RFCOMM socket layer registration failed");
1081 goto error;
1082 }
1083
1084 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1085 if (err < 0) {
1086 BT_ERR("Failed to create RFCOMM proc file");
1087 bt_sock_unregister(BTPROTO_RFCOMM);
1088 goto error;
1089 }
1090
1091 BT_INFO("RFCOMM socket layer initialized");
1092
1093 if (IS_ERR_OR_NULL(bt_debugfs))
1094 return 0;
1095
1096 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1097 bt_debugfs, NULL,
1098 &rfcomm_sock_debugfs_fops);
1099
1100 return 0;
1101
1102 error:
1103 proto_unregister(&rfcomm_proto);
1104 return err;
1105 }
1106
rfcomm_cleanup_sockets(void)1107 void __exit rfcomm_cleanup_sockets(void)
1108 {
1109 bt_procfs_cleanup(&init_net, "rfcomm");
1110
1111 debugfs_remove(rfcomm_sock_debugfs);
1112
1113 bt_sock_unregister(BTPROTO_RFCOMM);
1114
1115 proto_unregister(&rfcomm_proto);
1116 }
1117