1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * RFCOMM sockets. 23 */ 24 #include <linux/compat.h> 25 #include <linux/export.h> 26 #include <linux/debugfs.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 static const struct proto_ops rfcomm_sock_ops; 36 37 static struct bt_sock_list rfcomm_sk_list = { 38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 39 }; 40 41 static void rfcomm_sock_close(struct sock *sk); 42 static void rfcomm_sock_kill(struct sock *sk); 43 44 /* ---- DLC callbacks ---- 45 * 46 * called under rfcomm_dlc_lock() 47 */ 48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 49 { 50 struct sock *sk = d->owner; 51 52 if (!sk) { 53 kfree_skb(skb); 54 return; 55 } 56 57 atomic_add(skb->len, &sk->sk_rmem_alloc); 58 skb_queue_tail(&sk->sk_receive_queue, skb); 59 sk->sk_data_ready(sk); 60 61 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 62 rfcomm_dlc_throttle(d); 63 } 64 65 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 66 __must_hold(&d->lock) 67 { 68 struct sock *sk = d->owner, *parent; 69 70 if (!sk) 71 return; 72 73 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 74 75 lock_sock(sk); 76 77 if (err) 78 sk->sk_err = err; 79 80 sk->sk_state = d->state; 81 82 parent = bt_sk(sk)->parent; 83 if (parent) { 84 if (d->state == BT_CLOSED) { 85 sock_set_flag(sk, SOCK_ZAPPED); 86 bt_accept_unlink(sk); 87 } 88 parent->sk_data_ready(parent); 89 } else { 90 if (d->state == BT_CONNECTED) 91 rfcomm_session_getaddr(d->session, 92 &rfcomm_pi(sk)->src, NULL); 93 sk->sk_state_change(sk); 94 } 95 96 release_sock(sk); 97 98 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 99 /* We have to drop DLC lock here, otherwise 100 * rfcomm_sock_destruct() will dead lock. */ 101 rfcomm_dlc_unlock(d); 102 rfcomm_sock_kill(sk); 103 rfcomm_dlc_lock(d); 104 } 105 } 106 107 /* ---- Socket functions ---- */ 108 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 109 { 110 struct sock *sk = NULL; 111 112 sk_for_each(sk, &rfcomm_sk_list.head) { 113 if (rfcomm_pi(sk)->channel != channel) 114 continue; 115 116 if (bacmp(&rfcomm_pi(sk)->src, src)) 117 continue; 118 119 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 120 break; 121 } 122 123 return sk ? sk : NULL; 124 } 125 126 /* Find socket with channel and source bdaddr. 127 * Returns closest match with an extra reference held. 128 */ 129 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 130 { 131 struct sock *sk = NULL, *sk1 = NULL; 132 133 read_lock(&rfcomm_sk_list.lock); 134 135 sk_for_each(sk, &rfcomm_sk_list.head) { 136 if (state && sk->sk_state != state) 137 continue; 138 139 if (rfcomm_pi(sk)->channel == channel) { 140 /* Exact match. */ 141 if (!bacmp(&rfcomm_pi(sk)->src, src)) { 142 sock_hold(sk); 143 break; 144 } 145 146 /* Closest match */ 147 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) { 148 if (sk1) 149 sock_put(sk1); 150 151 sk1 = sk; 152 sock_hold(sk1); 153 } 154 } 155 } 156 157 if (sk && sk1) 158 sock_put(sk1); 159 160 read_unlock(&rfcomm_sk_list.lock); 161 162 return sk ? sk : sk1; 163 } 164 165 static void rfcomm_sock_destruct(struct sock *sk) 166 { 167 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 168 169 BT_DBG("sk %p dlc %p", sk, d); 170 171 skb_queue_purge(&sk->sk_receive_queue); 172 skb_queue_purge(&sk->sk_write_queue); 173 174 rfcomm_dlc_lock(d); 175 rfcomm_pi(sk)->dlc = NULL; 176 177 /* Detach DLC if it's owned by this socket */ 178 if (d->owner == sk) 179 d->owner = NULL; 180 rfcomm_dlc_unlock(d); 181 182 rfcomm_dlc_put(d); 183 } 184 185 static void rfcomm_sock_cleanup_listen(struct sock *parent) 186 { 187 struct sock *sk; 188 189 BT_DBG("parent %p", parent); 190 191 /* Close not yet accepted dlcs */ 192 while ((sk = bt_accept_dequeue(parent, NULL))) { 193 rfcomm_sock_close(sk); 194 rfcomm_sock_kill(sk); 195 /* Drop the reference handed back by bt_accept_dequeue(). */ 196 sock_put(sk); 197 } 198 199 parent->sk_state = BT_CLOSED; 200 sock_set_flag(parent, SOCK_ZAPPED); 201 } 202 203 /* Kill socket (only if zapped and orphan) 204 * Must be called on unlocked socket. 205 */ 206 static void rfcomm_sock_kill(struct sock *sk) 207 { 208 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 209 return; 210 211 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 212 213 /* Kill poor orphan */ 214 bt_sock_unlink(&rfcomm_sk_list, sk); 215 sock_set_flag(sk, SOCK_DEAD); 216 sock_put(sk); 217 } 218 219 static void __rfcomm_sock_close(struct sock *sk) 220 { 221 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 222 223 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 224 225 switch (sk->sk_state) { 226 case BT_LISTEN: 227 rfcomm_sock_cleanup_listen(sk); 228 break; 229 230 case BT_CONNECT: 231 case BT_CONNECT2: 232 case BT_CONFIG: 233 case BT_CONNECTED: 234 rfcomm_dlc_close(d, 0); 235 fallthrough; 236 237 default: 238 sock_set_flag(sk, SOCK_ZAPPED); 239 break; 240 } 241 } 242 243 /* Close socket. 244 * Must be called on unlocked socket. 245 */ 246 static void rfcomm_sock_close(struct sock *sk) 247 { 248 __rfcomm_sock_close(sk); 249 } 250 251 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 252 { 253 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 254 255 BT_DBG("sk %p", sk); 256 257 if (parent) { 258 sk->sk_type = parent->sk_type; 259 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 260 &bt_sk(parent)->flags); 261 262 pi->sec_level = rfcomm_pi(parent)->sec_level; 263 pi->role_switch = rfcomm_pi(parent)->role_switch; 264 265 security_sk_clone(parent, sk); 266 } else { 267 pi->dlc->defer_setup = 0; 268 269 pi->sec_level = BT_SECURITY_LOW; 270 pi->role_switch = 0; 271 } 272 273 pi->dlc->sec_level = pi->sec_level; 274 pi->dlc->role_switch = pi->role_switch; 275 } 276 277 static struct proto rfcomm_proto = { 278 .name = "RFCOMM", 279 .owner = THIS_MODULE, 280 .obj_size = sizeof(struct rfcomm_pinfo) 281 }; 282 283 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, 284 int proto, gfp_t prio, int kern) 285 { 286 struct rfcomm_dlc *d; 287 struct sock *sk; 288 289 d = rfcomm_dlc_alloc(prio); 290 if (!d) 291 return NULL; 292 293 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); 294 if (!sk) { 295 rfcomm_dlc_free(d); 296 return NULL; 297 } 298 299 d->data_ready = rfcomm_sk_data_ready; 300 d->state_change = rfcomm_sk_state_change; 301 302 rfcomm_pi(sk)->dlc = d; 303 d->owner = sk; 304 305 sk->sk_destruct = rfcomm_sock_destruct; 306 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 307 308 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 309 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 310 311 bt_sock_link(&rfcomm_sk_list, sk); 312 313 BT_DBG("sk %p", sk); 314 return sk; 315 } 316 317 static int rfcomm_sock_create(struct net *net, struct socket *sock, 318 int protocol, int kern) 319 { 320 struct sock *sk; 321 322 BT_DBG("sock %p", sock); 323 324 sock->state = SS_UNCONNECTED; 325 326 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 327 return -ESOCKTNOSUPPORT; 328 329 sock->ops = &rfcomm_sock_ops; 330 331 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 332 if (!sk) 333 return -ENOMEM; 334 335 rfcomm_sock_init(sk, NULL); 336 return 0; 337 } 338 339 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len) 340 { 341 struct sockaddr_rc sa; 342 struct sock *sk = sock->sk; 343 int len, err = 0; 344 345 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 346 addr->sa_family != AF_BLUETOOTH) 347 return -EINVAL; 348 349 memset(&sa, 0, sizeof(sa)); 350 len = min_t(unsigned int, sizeof(sa), addr_len); 351 memcpy(&sa, addr, len); 352 353 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 354 355 lock_sock(sk); 356 357 if (sk->sk_state != BT_OPEN) { 358 err = -EBADFD; 359 goto done; 360 } 361 362 if (sk->sk_type != SOCK_STREAM) { 363 err = -EINVAL; 364 goto done; 365 } 366 367 write_lock(&rfcomm_sk_list.lock); 368 369 if (sa.rc_channel && 370 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 371 err = -EADDRINUSE; 372 } else { 373 /* Save source address */ 374 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 375 rfcomm_pi(sk)->channel = sa.rc_channel; 376 sk->sk_state = BT_BOUND; 377 } 378 379 write_unlock(&rfcomm_sk_list.lock); 380 381 done: 382 release_sock(sk); 383 return err; 384 } 385 386 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 387 int alen, int flags) 388 { 389 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 390 struct sock *sk = sock->sk; 391 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 392 int err = 0; 393 394 BT_DBG("sk %p", sk); 395 396 if (alen < sizeof(struct sockaddr_rc) || 397 addr->sa_family != AF_BLUETOOTH) 398 return -EINVAL; 399 400 sock_hold(sk); 401 lock_sock(sk); 402 403 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 404 err = -EBADFD; 405 goto done; 406 } 407 408 if (sk->sk_type != SOCK_STREAM) { 409 err = -EINVAL; 410 goto done; 411 } 412 413 sk->sk_state = BT_CONNECT; 414 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 415 rfcomm_pi(sk)->channel = sa->rc_channel; 416 417 d->sec_level = rfcomm_pi(sk)->sec_level; 418 d->role_switch = rfcomm_pi(sk)->role_switch; 419 420 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ 421 release_sock(sk); 422 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 423 sa->rc_channel); 424 lock_sock(sk); 425 if (!err && !sock_flag(sk, SOCK_ZAPPED)) 426 err = bt_sock_wait_state(sk, BT_CONNECTED, 427 sock_sndtimeo(sk, flags & O_NONBLOCK)); 428 429 done: 430 release_sock(sk); 431 sock_put(sk); 432 return err; 433 } 434 435 static int rfcomm_sock_listen(struct socket *sock, int backlog) 436 { 437 struct sock *sk = sock->sk; 438 int err = 0; 439 440 BT_DBG("sk %p backlog %d", sk, backlog); 441 442 lock_sock(sk); 443 444 if (sk->sk_state != BT_BOUND) { 445 err = -EBADFD; 446 goto done; 447 } 448 449 if (sk->sk_type != SOCK_STREAM) { 450 err = -EINVAL; 451 goto done; 452 } 453 454 if (!rfcomm_pi(sk)->channel) { 455 bdaddr_t *src = &rfcomm_pi(sk)->src; 456 u8 channel; 457 458 err = -EINVAL; 459 460 write_lock(&rfcomm_sk_list.lock); 461 462 for (channel = 1; channel < 31; channel++) 463 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 464 rfcomm_pi(sk)->channel = channel; 465 err = 0; 466 break; 467 } 468 469 write_unlock(&rfcomm_sk_list.lock); 470 471 if (err < 0) 472 goto done; 473 } 474 475 sk->sk_max_ack_backlog = backlog; 476 sk->sk_ack_backlog = 0; 477 sk->sk_state = BT_LISTEN; 478 479 done: 480 release_sock(sk); 481 return err; 482 } 483 484 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, 485 struct proto_accept_arg *arg) 486 { 487 DEFINE_WAIT_FUNC(wait, woken_wake_function); 488 struct sock *sk = sock->sk, *nsk; 489 long timeo; 490 int err = 0; 491 492 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 493 494 if (sk->sk_type != SOCK_STREAM) { 495 err = -EINVAL; 496 goto done; 497 } 498 499 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 500 501 BT_DBG("sk %p timeo %ld", sk, timeo); 502 503 /* Wait for an incoming connection. (wake-one). */ 504 add_wait_queue_exclusive(sk_sleep(sk), &wait); 505 while (1) { 506 if (sk->sk_state != BT_LISTEN) { 507 err = -EBADFD; 508 break; 509 } 510 511 nsk = bt_accept_dequeue(sk, newsock); 512 if (nsk) { 513 /* Drop the bridging ref from bt_accept_dequeue(); 514 * the grafted socket keeps nsk alive from here. 515 */ 516 sock_put(nsk); 517 break; 518 } 519 520 if (!timeo) { 521 err = -EAGAIN; 522 break; 523 } 524 525 if (signal_pending(current)) { 526 err = sock_intr_errno(timeo); 527 break; 528 } 529 530 release_sock(sk); 531 532 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 533 534 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 535 } 536 remove_wait_queue(sk_sleep(sk), &wait); 537 538 if (err) 539 goto done; 540 541 newsock->state = SS_CONNECTED; 542 543 BT_DBG("new socket %p", nsk); 544 545 done: 546 release_sock(sk); 547 return err; 548 } 549 550 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 551 { 552 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 553 struct sock *sk = sock->sk; 554 555 BT_DBG("sock %p, sk %p", sock, sk); 556 557 if (peer && sk->sk_state != BT_CONNECTED && 558 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 559 return -ENOTCONN; 560 561 memset(sa, 0, sizeof(*sa)); 562 sa->rc_family = AF_BLUETOOTH; 563 sa->rc_channel = rfcomm_pi(sk)->channel; 564 if (peer) 565 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 566 else 567 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 568 569 return sizeof(struct sockaddr_rc); 570 } 571 572 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 573 size_t len) 574 { 575 struct sock *sk = sock->sk; 576 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 577 struct sk_buff *skb; 578 int sent; 579 580 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 581 return -ENOTCONN; 582 583 if (msg->msg_flags & MSG_OOB) 584 return -EOPNOTSUPP; 585 586 if (sk->sk_shutdown & SEND_SHUTDOWN) 587 return -EPIPE; 588 589 BT_DBG("sock %p, sk %p", sock, sk); 590 591 lock_sock(sk); 592 593 sent = bt_sock_wait_ready(sk, msg->msg_flags); 594 595 release_sock(sk); 596 597 if (sent) 598 return sent; 599 600 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, 601 RFCOMM_SKB_TAIL_RESERVE); 602 if (IS_ERR(skb)) 603 return PTR_ERR(skb); 604 605 sent = rfcomm_dlc_send(d, skb); 606 if (sent < 0) 607 kfree_skb(skb); 608 609 return sent; 610 } 611 612 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 613 size_t size, int flags) 614 { 615 struct sock *sk = sock->sk; 616 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 617 int len; 618 619 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 620 rfcomm_dlc_accept(d); 621 return 0; 622 } 623 624 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 625 626 lock_sock(sk); 627 if (!(flags & MSG_PEEK) && len > 0) 628 atomic_sub(len, &sk->sk_rmem_alloc); 629 630 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 631 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 632 release_sock(sk); 633 634 return len; 635 } 636 637 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 638 sockptr_t optval, unsigned int optlen) 639 { 640 struct sock *sk = sock->sk; 641 int err = 0; 642 u32 opt; 643 644 BT_DBG("sk %p", sk); 645 646 lock_sock(sk); 647 648 switch (optname) { 649 case RFCOMM_LM: 650 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 651 if (err) 652 break; 653 654 if (opt & RFCOMM_LM_FIPS) { 655 err = -EINVAL; 656 break; 657 } 658 659 if (opt & RFCOMM_LM_AUTH) 660 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 661 if (opt & RFCOMM_LM_ENCRYPT) 662 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 663 if (opt & RFCOMM_LM_SECURE) 664 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 665 666 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 667 break; 668 669 default: 670 err = -ENOPROTOOPT; 671 break; 672 } 673 674 release_sock(sk); 675 return err; 676 } 677 678 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 679 sockptr_t optval, unsigned int optlen) 680 { 681 struct sock *sk = sock->sk; 682 struct bt_security sec; 683 int err = 0; 684 u32 opt; 685 686 BT_DBG("sk %p", sk); 687 688 if (level == SOL_RFCOMM) 689 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 690 691 if (level != SOL_BLUETOOTH) 692 return -ENOPROTOOPT; 693 694 lock_sock(sk); 695 696 switch (optname) { 697 case BT_SECURITY: 698 if (sk->sk_type != SOCK_STREAM) { 699 err = -EINVAL; 700 break; 701 } 702 703 sec.level = BT_SECURITY_LOW; 704 705 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 706 if (err) 707 break; 708 709 if (sec.level > BT_SECURITY_HIGH) { 710 err = -EINVAL; 711 break; 712 } 713 714 rfcomm_pi(sk)->sec_level = sec.level; 715 break; 716 717 case BT_DEFER_SETUP: 718 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 719 err = -EINVAL; 720 break; 721 } 722 723 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 724 if (err) 725 break; 726 727 if (opt) 728 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 729 else 730 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 731 732 break; 733 734 default: 735 err = -ENOPROTOOPT; 736 break; 737 } 738 739 release_sock(sk); 740 return err; 741 } 742 743 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, 744 sockopt_t *sopt) 745 { 746 struct sock *sk = sock->sk; 747 struct sock *l2cap_sk; 748 struct l2cap_conn *conn; 749 struct rfcomm_conninfo cinfo; 750 int err = 0; 751 size_t len; 752 u32 opt; 753 754 BT_DBG("sk %p", sk); 755 756 len = sopt->optlen; 757 758 lock_sock(sk); 759 760 switch (optname) { 761 case RFCOMM_LM: 762 switch (rfcomm_pi(sk)->sec_level) { 763 case BT_SECURITY_LOW: 764 opt = RFCOMM_LM_AUTH; 765 break; 766 case BT_SECURITY_MEDIUM: 767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 768 break; 769 case BT_SECURITY_HIGH: 770 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 771 RFCOMM_LM_SECURE; 772 break; 773 case BT_SECURITY_FIPS: 774 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 775 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 776 break; 777 default: 778 opt = 0; 779 break; 780 } 781 782 if (rfcomm_pi(sk)->role_switch) 783 opt |= RFCOMM_LM_MASTER; 784 785 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 786 sizeof(opt)) 787 err = -EFAULT; 788 789 break; 790 791 case RFCOMM_CONNINFO: 792 if ((sk->sk_state != BT_CONNECTED && 793 !(sk->sk_state == BT_CONNECT2 && 794 rfcomm_pi(sk)->dlc->defer_setup)) || 795 !rfcomm_pi(sk)->dlc->session) { 796 err = -ENOTCONN; 797 break; 798 } 799 800 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 801 conn = l2cap_pi(l2cap_sk)->chan->conn; 802 803 memset(&cinfo, 0, sizeof(cinfo)); 804 cinfo.hci_handle = conn->hcon->handle; 805 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 806 807 len = min(len, sizeof(cinfo)); 808 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 809 err = -EFAULT; 810 811 break; 812 813 default: 814 err = -ENOPROTOOPT; 815 break; 816 } 817 818 release_sock(sk); 819 return err; 820 } 821 822 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, 823 sockopt_t *sopt) 824 { 825 struct sock *sk = sock->sk; 826 struct bt_security sec; 827 int err = 0; 828 size_t len; 829 u32 opt; 830 831 BT_DBG("sk %p", sk); 832 833 if (level == SOL_RFCOMM) 834 return rfcomm_sock_getsockopt_old(sock, optname, sopt); 835 836 if (level != SOL_BLUETOOTH) 837 return -ENOPROTOOPT; 838 839 len = sopt->optlen; 840 841 lock_sock(sk); 842 843 switch (optname) { 844 case BT_SECURITY: 845 if (sk->sk_type != SOCK_STREAM) { 846 err = -EINVAL; 847 break; 848 } 849 850 sec.level = rfcomm_pi(sk)->sec_level; 851 sec.key_size = 0; 852 853 len = min(len, sizeof(sec)); 854 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 855 err = -EFAULT; 856 857 break; 858 859 case BT_DEFER_SETUP: 860 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 861 err = -EINVAL; 862 break; 863 } 864 865 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 866 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 867 sizeof(opt)) 868 err = -EFAULT; 869 870 break; 871 872 default: 873 err = -ENOPROTOOPT; 874 break; 875 } 876 877 release_sock(sk); 878 return err; 879 } 880 881 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 882 { 883 struct sock *sk __maybe_unused = sock->sk; 884 int err; 885 886 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 887 888 err = bt_sock_ioctl(sock, cmd, arg); 889 890 if (err == -ENOIOCTLCMD) { 891 #ifdef CONFIG_BT_RFCOMM_TTY 892 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 893 #else 894 err = -EOPNOTSUPP; 895 #endif 896 } 897 898 return err; 899 } 900 901 #ifdef CONFIG_COMPAT 902 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 903 { 904 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 905 } 906 #endif 907 908 static int rfcomm_sock_shutdown(struct socket *sock, int how) 909 { 910 struct sock *sk = sock->sk; 911 bool cleanup_listen = false; 912 int err = 0; 913 914 BT_DBG("sock %p, sk %p", sock, sk); 915 916 if (!sk) 917 return 0; 918 919 lock_sock(sk); 920 if (!sk->sk_shutdown) { 921 sk->sk_shutdown = SHUTDOWN_MASK; 922 if (sk->sk_state == BT_LISTEN) { 923 /* Block new children before cleaning up without sk lock. */ 924 sk->sk_state = BT_CLOSED; 925 cleanup_listen = true; 926 } 927 928 release_sock(sk); 929 if (cleanup_listen) 930 rfcomm_sock_cleanup_listen(sk); 931 else 932 __rfcomm_sock_close(sk); 933 lock_sock(sk); 934 935 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 936 !(current->flags & PF_EXITING)) 937 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 938 } 939 release_sock(sk); 940 return err; 941 } 942 943 static int rfcomm_sock_release(struct socket *sock) 944 { 945 struct sock *sk = sock->sk; 946 int err; 947 948 BT_DBG("sock %p, sk %p", sock, sk); 949 950 if (!sk) 951 return 0; 952 953 err = rfcomm_sock_shutdown(sock, 2); 954 955 sock_orphan(sk); 956 rfcomm_sock_kill(sk); 957 return err; 958 } 959 960 /* ---- RFCOMM core layer callbacks ---- 961 * 962 * called under rfcomm_lock() 963 */ 964 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 965 { 966 struct sock *sk, *parent; 967 bdaddr_t src, dst; 968 bool defer_setup = false; 969 int result = 0; 970 971 BT_DBG("session %p channel %d", s, channel); 972 973 rfcomm_session_getaddr(s, &src, &dst); 974 975 /* Check if we have socket listening on channel */ 976 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 977 if (!parent) 978 return 0; 979 980 lock_sock(parent); 981 982 if (parent->sk_state != BT_LISTEN) 983 goto done; 984 985 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags); 986 987 /* Check for backlog size */ 988 if (sk_acceptq_is_full(parent)) { 989 BT_DBG("backlog full %d", parent->sk_ack_backlog); 990 goto done; 991 } 992 993 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 994 if (!sk) 995 goto done; 996 997 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 998 999 rfcomm_sock_init(sk, parent); 1000 bacpy(&rfcomm_pi(sk)->src, &src); 1001 bacpy(&rfcomm_pi(sk)->dst, &dst); 1002 rfcomm_pi(sk)->channel = channel; 1003 1004 sk->sk_state = BT_CONFIG; 1005 bt_accept_enqueue(parent, sk, true); 1006 1007 /* Accept connection and return socket DLC */ 1008 *d = rfcomm_pi(sk)->dlc; 1009 result = 1; 1010 1011 done: 1012 release_sock(parent); 1013 1014 if (defer_setup) 1015 parent->sk_state_change(parent); 1016 1017 sock_put(parent); 1018 1019 return result; 1020 } 1021 1022 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1023 { 1024 struct sock *sk; 1025 1026 read_lock(&rfcomm_sk_list.lock); 1027 1028 sk_for_each(sk, &rfcomm_sk_list.head) { 1029 seq_printf(f, "%pMR %pMR %d %d\n", 1030 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1031 sk->sk_state, rfcomm_pi(sk)->channel); 1032 } 1033 1034 read_unlock(&rfcomm_sk_list.lock); 1035 1036 return 0; 1037 } 1038 1039 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs); 1040 1041 static struct dentry *rfcomm_sock_debugfs; 1042 1043 static const struct proto_ops rfcomm_sock_ops = { 1044 .family = PF_BLUETOOTH, 1045 .owner = THIS_MODULE, 1046 .release = rfcomm_sock_release, 1047 .bind = rfcomm_sock_bind, 1048 .connect = rfcomm_sock_connect, 1049 .listen = rfcomm_sock_listen, 1050 .accept = rfcomm_sock_accept, 1051 .getname = rfcomm_sock_getname, 1052 .sendmsg = rfcomm_sock_sendmsg, 1053 .recvmsg = rfcomm_sock_recvmsg, 1054 .shutdown = rfcomm_sock_shutdown, 1055 .setsockopt = rfcomm_sock_setsockopt, 1056 .getsockopt_iter = rfcomm_sock_getsockopt, 1057 .ioctl = rfcomm_sock_ioctl, 1058 .gettstamp = sock_gettstamp, 1059 .poll = bt_sock_poll, 1060 .socketpair = sock_no_socketpair, 1061 .mmap = sock_no_mmap, 1062 #ifdef CONFIG_COMPAT 1063 .compat_ioctl = rfcomm_sock_compat_ioctl, 1064 #endif 1065 }; 1066 1067 static const struct net_proto_family rfcomm_sock_family_ops = { 1068 .family = PF_BLUETOOTH, 1069 .owner = THIS_MODULE, 1070 .create = rfcomm_sock_create 1071 }; 1072 1073 int __init rfcomm_init_sockets(void) 1074 { 1075 int err; 1076 1077 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1078 1079 err = proto_register(&rfcomm_proto, 0); 1080 if (err < 0) 1081 return err; 1082 1083 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1084 if (err < 0) { 1085 BT_ERR("RFCOMM socket layer registration failed"); 1086 goto error; 1087 } 1088 1089 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1090 if (err < 0) { 1091 BT_ERR("Failed to create RFCOMM proc file"); 1092 bt_sock_unregister(BTPROTO_RFCOMM); 1093 goto error; 1094 } 1095 1096 BT_INFO("RFCOMM socket layer initialized"); 1097 1098 if (IS_ERR_OR_NULL(bt_debugfs)) 1099 return 0; 1100 1101 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1102 bt_debugfs, NULL, 1103 &rfcomm_sock_debugfs_fops); 1104 1105 return 0; 1106 1107 error: 1108 proto_unregister(&rfcomm_proto); 1109 return err; 1110 } 1111 1112 void __exit rfcomm_cleanup_sockets(void) 1113 { 1114 bt_procfs_cleanup(&init_net, "rfcomm"); 1115 1116 debugfs_remove(rfcomm_sock_debugfs); 1117 1118 bt_sock_unregister(BTPROTO_RFCOMM); 1119 1120 proto_unregister(&rfcomm_proto); 1121 } 1122