1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2000-2001 Qualcomm Incorporated
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth SCO sockets. */
23
24 #include <linux/module.h>
25 #include <linux/debugfs.h>
26 #include <linux/seq_file.h>
27 #include <linux/sched/signal.h>
28 #include <linux/uio.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/sco.h>
33
34 static bool disable_esco;
35
36 static const struct proto_ops sco_sock_ops;
37
38 static struct bt_sock_list sco_sk_list = {
39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
40 };
41
42 /* ---- SCO connections ---- */
43 struct sco_conn {
44 struct hci_conn *hcon;
45
46 spinlock_t lock;
47 struct sock *sk;
48
49 struct delayed_work timeout_work;
50
51 unsigned int mtu;
52 struct kref ref;
53 };
54
55 #define sco_conn_lock(c) spin_lock(&c->lock)
56 #define sco_conn_unlock(c) spin_unlock(&c->lock)
57
58 static void sco_sock_close(struct sock *sk);
59 static void sco_sock_kill(struct sock *sk);
60
61 /* ----- SCO socket info ----- */
62 #define sco_pi(sk) ((struct sco_pinfo *) sk)
63
64 struct sco_pinfo {
65 struct bt_sock bt;
66 bdaddr_t src;
67 bdaddr_t dst;
68 __u32 flags;
69 __u16 setting;
70 struct bt_codec codec;
71 struct sco_conn *conn;
72 };
73
74 /* ---- SCO timers ---- */
75 #define SCO_CONN_TIMEOUT (HZ * 40)
76 #define SCO_DISCONN_TIMEOUT (HZ * 2)
77
sco_conn_free(struct kref * ref)78 static void sco_conn_free(struct kref *ref)
79 {
80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref);
81
82 BT_DBG("conn %p", conn);
83
84 if (conn->sk)
85 sco_pi(conn->sk)->conn = NULL;
86
87 /* hcon->sco_data is cleared and the association's reference on the
88 * sco_conn is dropped in sco_conn_del() under hdev->lock, and the
89 * hci_conn is now owned by the socket (held in __sco_chan_add() and
90 * dropped in sco_chan_del()/sco_sock_destruct()), so there is nothing
91 * left to release towards hcon here.
92 */
93
94 /* Ensure no more work items will run before the connection is freed */
95 disable_delayed_work_sync(&conn->timeout_work);
96
97 kfree(conn);
98 }
99
sco_conn_put(struct sco_conn * conn)100 static void sco_conn_put(struct sco_conn *conn)
101 {
102 if (!conn)
103 return;
104
105 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
106
107 kref_put(&conn->ref, sco_conn_free);
108 }
109
sco_conn_hold(struct sco_conn * conn)110 static struct sco_conn *sco_conn_hold(struct sco_conn *conn)
111 {
112 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
113
114 kref_get(&conn->ref);
115 return conn;
116 }
117
sco_conn_hold_unless_zero(struct sco_conn * conn)118 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn)
119 {
120 if (!conn)
121 return NULL;
122
123 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
124
125 if (!kref_get_unless_zero(&conn->ref))
126 return NULL;
127
128 return conn;
129 }
130
sco_sock_hold(struct sco_conn * conn)131 static struct sock *sco_sock_hold(struct sco_conn *conn)
132 {
133 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
134 return NULL;
135
136 sock_hold(conn->sk);
137
138 return conn->sk;
139 }
140
sco_sock_timeout(struct work_struct * work)141 static void sco_sock_timeout(struct work_struct *work)
142 {
143 struct sco_conn *conn = container_of(work, struct sco_conn,
144 timeout_work.work);
145 struct sock *sk;
146
147 conn = sco_conn_hold_unless_zero(conn);
148 if (!conn)
149 return;
150
151 sco_conn_lock(conn);
152 if (!conn->hcon) {
153 sco_conn_unlock(conn);
154 sco_conn_put(conn);
155 return;
156 }
157 sk = sco_sock_hold(conn);
158 sco_conn_unlock(conn);
159 sco_conn_put(conn);
160
161 if (!sk)
162 return;
163
164 BT_DBG("sock %p state %d", sk, sk->sk_state);
165
166 lock_sock(sk);
167 sk->sk_err = ETIMEDOUT;
168 sk->sk_state_change(sk);
169 release_sock(sk);
170 sock_put(sk);
171 }
172
sco_sock_set_timer(struct sock * sk,long timeout)173 static void sco_sock_set_timer(struct sock *sk, long timeout)
174 {
175 if (!sco_pi(sk)->conn)
176 return;
177
178 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
179 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
180 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
181 }
182
sco_sock_clear_timer(struct sock * sk)183 static void sco_sock_clear_timer(struct sock *sk)
184 {
185 if (!sco_pi(sk)->conn)
186 return;
187
188 BT_DBG("sock %p state %d", sk, sk->sk_state);
189 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
190 }
191
192 /* ---- SCO connections ---- */
193 /* Returns a new reference the caller must drop with sco_conn_put(). The
194 * hcon->sco_data association holds its own reference on the sco_conn for the
195 * connection's lifetime; it is dropped in sco_conn_del() under hdev->lock.
196 * @hcon is not consumed: the hci_conn reference is taken and owned by the
197 * socket in __sco_chan_add().
198 */
sco_conn_add(struct hci_conn * hcon)199 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
200 {
201 struct sco_conn *conn = hcon->sco_data;
202
203 conn = sco_conn_hold_unless_zero(conn);
204 if (conn)
205 return conn;
206
207 conn = kzalloc_obj(struct sco_conn);
208 if (!conn)
209 return NULL;
210
211 kref_init(&conn->ref);
212 spin_lock_init(&conn->lock);
213 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
214
215 hcon->sco_data = conn;
216 conn->hcon = hcon;
217 conn->mtu = hcon->mtu;
218
219 if (hcon->mtu > 0)
220 conn->mtu = hcon->mtu;
221 else
222 conn->mtu = 60;
223
224 BT_DBG("hcon %p conn %p", hcon, conn);
225
226 /* kref_init() above set the association reference owned by
227 * hcon->sco_data; hand the caller its own reference.
228 */
229 return sco_conn_hold(conn);
230 }
231
232 /* Delete channel.
233 * Must be called on the locked socket. */
sco_chan_del(struct sock * sk,int err)234 static void sco_chan_del(struct sock *sk, int err)
235 {
236 struct sco_conn *conn;
237
238 conn = sco_pi(sk)->conn;
239 sco_pi(sk)->conn = NULL;
240
241 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
242
243 if (conn) {
244 struct hci_conn *hcon;
245
246 sco_conn_lock(conn);
247 hcon = conn->hcon;
248 sco_conn_unlock(conn);
249
250 /* Drop the socket's hci_conn reference BEFORE clearing
251 * conn->sk, so sco_conn_del() on another CPU cannot free
252 * the hci_conn while we still hold a pointer to it.
253 */
254 if (hcon)
255 hci_conn_drop(hcon);
256
257 sco_conn_lock(conn);
258 conn->sk = NULL;
259 sco_conn_unlock(conn);
260 sco_conn_put(conn);
261 }
262
263 sk->sk_state = BT_CLOSED;
264 sk->sk_err = err;
265 sk->sk_state_change(sk);
266
267 sock_set_flag(sk, SOCK_ZAPPED);
268 }
269
sco_conn_del(struct hci_conn * hcon,int err)270 static void sco_conn_del(struct hci_conn *hcon, int err)
271 {
272 struct sco_conn *conn = hcon->sco_data;
273 struct sock *sk;
274
275 conn = sco_conn_hold_unless_zero(conn);
276 if (!conn)
277 return;
278
279 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
280
281 /* Detach from the hci_conn and drop the association's reference.
282 * The caller holds hdev->lock, which serialises this against the
283 * read of hcon->sco_data in sco_recv_scodata().
284 */
285 hcon->sco_data = NULL;
286 sco_conn_put(conn);
287
288 sco_conn_lock(conn);
289 sk = sco_sock_hold(conn);
290 sco_conn_unlock(conn);
291 sco_conn_put(conn);
292
293 if (!sk)
294 return;
295
296 /* Kill socket */
297 lock_sock(sk);
298 sco_sock_clear_timer(sk);
299 sco_chan_del(sk, err);
300 release_sock(sk);
301 sock_put(sk);
302 }
303
__sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)304 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
305 struct sock *parent)
306 {
307 BT_DBG("conn %p", conn);
308
309 sco_pi(sk)->conn = sco_conn_hold(conn);
310 conn->sk = sk;
311
312 /* The socket owns an hci_conn reference for as long as it stays
313 * attached; it is dropped in sco_chan_del()/sco_sock_destruct().
314 */
315 hci_conn_hold(conn->hcon);
316
317 if (parent)
318 bt_accept_enqueue(parent, sk, true);
319 }
320
sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)321 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
322 struct sock *parent)
323 {
324 int err = 0;
325
326 sco_conn_lock(conn);
327 if (conn->sk || sco_pi(sk)->conn)
328 err = -EBUSY;
329 else
330 __sco_chan_add(conn, sk, parent);
331
332 sco_conn_unlock(conn);
333 return err;
334 }
335
sco_connect(struct sock * sk)336 static int sco_connect(struct sock *sk)
337 {
338 struct sco_conn *conn;
339 struct hci_conn *hcon;
340 struct hci_dev *hdev;
341 bdaddr_t src, dst;
342 struct bt_codec codec;
343 __u16 setting;
344 int err, type;
345
346 lock_sock(sk);
347 bacpy(&src, &sco_pi(sk)->src);
348 bacpy(&dst, &sco_pi(sk)->dst);
349 setting = sco_pi(sk)->setting;
350 codec = sco_pi(sk)->codec;
351 release_sock(sk);
352
353 BT_DBG("%pMR -> %pMR", &src, &dst);
354
355 hdev = hci_get_route(&dst, &src, BDADDR_BREDR);
356 if (!hdev)
357 return -EHOSTUNREACH;
358
359 hci_dev_lock(hdev);
360
361 if (lmp_esco_capable(hdev) && !disable_esco)
362 type = ESCO_LINK;
363 else
364 type = SCO_LINK;
365
366 switch (setting & SCO_AIRMODE_MASK) {
367 case SCO_AIRMODE_TRANSP:
368 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) {
369 err = -EOPNOTSUPP;
370 goto unlock;
371 }
372 break;
373 }
374
375 hcon = hci_connect_sco(hdev, type, &dst,
376 setting, &codec,
377 READ_ONCE(sk->sk_sndtimeo));
378 if (IS_ERR(hcon)) {
379 err = PTR_ERR(hcon);
380 goto unlock;
381 }
382
383 conn = sco_conn_add(hcon);
384 if (!conn) {
385 hci_conn_drop(hcon);
386 err = -ENOMEM;
387 goto unlock;
388 }
389
390 lock_sock(sk);
391
392 /* Recheck state after reacquiring the socket lock, as another
393 * thread may have changed it (e.g., closed the socket).
394 */
395 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
396 release_sock(sk);
397 sco_conn_put(conn);
398 hci_conn_drop(hcon);
399 err = -EBADFD;
400 goto unlock;
401 }
402
403 err = sco_chan_add(conn, sk, NULL);
404 sco_conn_put(conn);
405 if (err) {
406 release_sock(sk);
407 hci_conn_drop(hcon);
408 goto unlock;
409 }
410
411 /* __sco_chan_add() took its own hci_conn reference; drop ours. */
412 hci_conn_drop(hcon);
413
414 /* Update source addr of the socket */
415 bacpy(&sco_pi(sk)->src, &hcon->src);
416
417 if (hcon->state == BT_CONNECTED) {
418 sco_sock_clear_timer(sk);
419 sk->sk_state = BT_CONNECTED;
420 } else {
421 sk->sk_state = BT_CONNECT;
422 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
423 }
424
425 release_sock(sk);
426
427 unlock:
428 hci_dev_unlock(hdev);
429 hci_dev_put(hdev);
430 return err;
431 }
432
sco_send_frame(struct sock * sk,struct sk_buff * skb,const struct sockcm_cookie * sockc)433 static int sco_send_frame(struct sock *sk, struct sk_buff *skb,
434 const struct sockcm_cookie *sockc)
435 {
436 struct sco_conn *conn = sco_pi(sk)->conn;
437 int len = skb->len;
438
439 /* Check outgoing MTU */
440 if (len > conn->mtu)
441 return -EINVAL;
442
443 BT_DBG("sk %p len %d", sk, len);
444
445 hci_setup_tx_timestamp(skb, 1, sockc);
446 hci_send_sco(conn->hcon, skb);
447
448 return len;
449 }
450
sco_recv_frame(struct sco_conn * conn,struct sk_buff * skb)451 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
452 {
453 struct sock *sk;
454
455 sco_conn_lock(conn);
456 sk = sco_sock_hold(conn);
457 sco_conn_unlock(conn);
458
459 if (!sk)
460 goto drop;
461
462 BT_DBG("sk %p len %u", sk, skb->len);
463
464 if (sk->sk_state != BT_CONNECTED)
465 goto drop_put;
466
467 if (!sock_queue_rcv_skb(sk, skb)) {
468 sock_put(sk);
469 return;
470 }
471
472 drop_put:
473 sock_put(sk);
474 drop:
475 kfree_skb(skb);
476 }
477
478 /* -------- Socket interface ---------- */
__sco_get_sock_listen_by_addr(bdaddr_t * ba)479 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
480 {
481 struct sock *sk;
482
483 sk_for_each(sk, &sco_sk_list.head) {
484 if (sk->sk_state != BT_LISTEN)
485 continue;
486
487 if (!bacmp(&sco_pi(sk)->src, ba))
488 return sk;
489 }
490
491 return NULL;
492 }
493
494 /* Find socket listening on source bdaddr.
495 * Returns closest match.
496 */
sco_get_sock_listen(bdaddr_t * src)497 static struct sock *sco_get_sock_listen(bdaddr_t *src)
498 {
499 struct sock *sk = NULL, *sk1 = NULL;
500
501 read_lock(&sco_sk_list.lock);
502
503 sk_for_each(sk, &sco_sk_list.head) {
504 if (sk->sk_state != BT_LISTEN)
505 continue;
506
507 /* Exact match. */
508 if (!bacmp(&sco_pi(sk)->src, src))
509 break;
510
511 /* Closest match */
512 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
513 sk1 = sk;
514 }
515
516 sk = sk ? sk : sk1;
517 if (sk)
518 sock_hold(sk);
519
520 read_unlock(&sco_sk_list.lock);
521
522 return sk;
523 }
524
sco_sock_destruct(struct sock * sk)525 static void sco_sock_destruct(struct sock *sk)
526 {
527 struct sco_conn *conn = sco_pi(sk)->conn;
528
529 BT_DBG("sk %p", sk);
530
531 /* If the channel was not already torn down via sco_chan_del(), drop
532 * the socket's own references here.
533 */
534 if (conn) {
535 struct hci_conn *hcon;
536
537 sco_conn_lock(conn);
538 hcon = conn->hcon;
539 sco_conn_unlock(conn);
540
541 if (hcon)
542 hci_conn_drop(hcon);
543 sco_pi(sk)->conn = NULL;
544 sco_conn_put(conn);
545 }
546
547 skb_queue_purge(&sk->sk_receive_queue);
548 skb_queue_purge(&sk->sk_write_queue);
549 skb_queue_purge(&sk->sk_error_queue);
550 }
551
sco_sock_cleanup_listen(struct sock * parent)552 static void sco_sock_cleanup_listen(struct sock *parent)
553 {
554 struct sock *sk;
555
556 BT_DBG("parent %p", parent);
557
558 /* Close not yet accepted channels */
559 while ((sk = bt_accept_dequeue(parent, NULL))) {
560 sco_sock_close(sk);
561 sco_sock_kill(sk);
562 /* Drop the reference handed back by bt_accept_dequeue(). */
563 sock_put(sk);
564 }
565
566 parent->sk_state = BT_CLOSED;
567 sock_set_flag(parent, SOCK_ZAPPED);
568 }
569
570 /* Kill socket (only if zapped and orphan)
571 * Must be called on unlocked socket.
572 */
sco_sock_kill(struct sock * sk)573 static void sco_sock_kill(struct sock *sk)
574 {
575 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
576 return;
577
578 BT_DBG("sk %p state %d", sk, sk->sk_state);
579
580 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
581 lock_sock(sk);
582 if (sco_pi(sk)->conn) {
583 sco_conn_lock(sco_pi(sk)->conn);
584 sco_pi(sk)->conn->sk = NULL;
585 sco_conn_unlock(sco_pi(sk)->conn);
586 }
587 release_sock(sk);
588
589 /* Kill poor orphan */
590 bt_sock_unlink(&sco_sk_list, sk);
591 sock_set_flag(sk, SOCK_DEAD);
592 sock_put(sk);
593 }
594
__sco_sock_close(struct sock * sk)595 static void __sco_sock_close(struct sock *sk)
596 {
597 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
598
599 switch (sk->sk_state) {
600 case BT_LISTEN:
601 sco_sock_cleanup_listen(sk);
602 break;
603
604 case BT_CONNECTED:
605 case BT_CONFIG:
606 case BT_CONNECT2:
607 case BT_CONNECT:
608 case BT_DISCONN:
609 sco_chan_del(sk, ECONNRESET);
610 break;
611
612 default:
613 sock_set_flag(sk, SOCK_ZAPPED);
614 break;
615 }
616
617 }
618
619 /* Must be called on unlocked socket. */
sco_sock_close(struct sock * sk)620 static void sco_sock_close(struct sock *sk)
621 {
622 struct sco_conn *conn;
623
624 lock_sock(sk);
625 conn = sco_pi(sk)->conn;
626 if (conn)
627 sco_conn_hold(conn);
628 release_sock(sk);
629
630 if (conn)
631 disable_delayed_work_sync(&conn->timeout_work);
632
633 lock_sock(sk);
634 __sco_sock_close(sk);
635 release_sock(sk);
636
637 if (conn)
638 sco_conn_put(conn);
639 }
640
sco_sock_init(struct sock * sk,struct sock * parent)641 static void sco_sock_init(struct sock *sk, struct sock *parent)
642 {
643 BT_DBG("sk %p", sk);
644
645 if (parent) {
646 sk->sk_type = parent->sk_type;
647 bt_sk(sk)->flags = bt_sk(parent)->flags;
648 security_sk_clone(parent, sk);
649 }
650 }
651
652 static struct proto sco_proto = {
653 .name = "SCO",
654 .owner = THIS_MODULE,
655 .obj_size = sizeof(struct sco_pinfo)
656 };
657
sco_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)658 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
659 int proto, gfp_t prio, int kern)
660 {
661 struct sock *sk;
662
663 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
664 if (!sk)
665 return NULL;
666
667 sk->sk_destruct = sco_sock_destruct;
668 sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
669
670 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
671 sco_pi(sk)->codec.id = BT_CODEC_CVSD;
672 sco_pi(sk)->codec.cid = 0xffff;
673 sco_pi(sk)->codec.vid = 0xffff;
674 sco_pi(sk)->codec.data_path = 0x00;
675
676 bt_sock_link(&sco_sk_list, sk);
677 return sk;
678 }
679
sco_sock_create(struct net * net,struct socket * sock,int protocol,int kern)680 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
681 int kern)
682 {
683 struct sock *sk;
684
685 BT_DBG("sock %p", sock);
686
687 sock->state = SS_UNCONNECTED;
688
689 if (sock->type != SOCK_SEQPACKET)
690 return -ESOCKTNOSUPPORT;
691
692 sock->ops = &sco_sock_ops;
693
694 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
695 if (!sk)
696 return -ENOMEM;
697
698 sco_sock_init(sk, NULL);
699 return 0;
700 }
701
sco_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int addr_len)702 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
703 int addr_len)
704 {
705 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
706 struct sock *sk = sock->sk;
707 int err = 0;
708
709 if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
710 addr->sa_family != AF_BLUETOOTH)
711 return -EINVAL;
712
713 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
714
715 lock_sock(sk);
716
717 if (sk->sk_state != BT_OPEN) {
718 err = -EBADFD;
719 goto done;
720 }
721
722 if (sk->sk_type != SOCK_SEQPACKET) {
723 err = -EINVAL;
724 goto done;
725 }
726
727 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
728
729 sk->sk_state = BT_BOUND;
730
731 done:
732 release_sock(sk);
733 return err;
734 }
735
sco_sock_connect(struct socket * sock,struct sockaddr_unsized * addr,int alen,int flags)736 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags)
737 {
738 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
739 struct sock *sk = sock->sk;
740 int err;
741
742 BT_DBG("sk %p", sk);
743
744 if (alen < sizeof(struct sockaddr_sco) ||
745 addr->sa_family != AF_BLUETOOTH)
746 return -EINVAL;
747
748 lock_sock(sk);
749
750 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
751 release_sock(sk);
752 return -EBADFD;
753 }
754
755 if (sk->sk_type != SOCK_SEQPACKET) {
756 release_sock(sk);
757 return -EINVAL;
758 }
759
760 /* Set destination address and psm */
761 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
762 release_sock(sk);
763
764 err = sco_connect(sk);
765 if (err)
766 return err;
767
768 lock_sock(sk);
769
770 err = bt_sock_wait_state(sk, BT_CONNECTED,
771 sock_sndtimeo(sk, flags & O_NONBLOCK));
772
773 release_sock(sk);
774 return err;
775 }
776
sco_sock_listen(struct socket * sock,int backlog)777 static int sco_sock_listen(struct socket *sock, int backlog)
778 {
779 struct sock *sk = sock->sk;
780 bdaddr_t *src = &sco_pi(sk)->src;
781 int err = 0;
782
783 BT_DBG("sk %p backlog %d", sk, backlog);
784
785 lock_sock(sk);
786
787 if (sk->sk_state != BT_BOUND) {
788 err = -EBADFD;
789 goto done;
790 }
791
792 if (sk->sk_type != SOCK_SEQPACKET) {
793 err = -EINVAL;
794 goto done;
795 }
796
797 write_lock(&sco_sk_list.lock);
798
799 if (__sco_get_sock_listen_by_addr(src)) {
800 err = -EADDRINUSE;
801 goto unlock;
802 }
803
804 sk->sk_max_ack_backlog = backlog;
805 sk->sk_ack_backlog = 0;
806
807 sk->sk_state = BT_LISTEN;
808
809 unlock:
810 write_unlock(&sco_sk_list.lock);
811
812 done:
813 release_sock(sk);
814 return err;
815 }
816
sco_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)817 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
818 struct proto_accept_arg *arg)
819 {
820 DEFINE_WAIT_FUNC(wait, woken_wake_function);
821 struct sock *sk = sock->sk, *ch;
822 long timeo;
823 int err = 0;
824
825 lock_sock(sk);
826
827 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
828
829 BT_DBG("sk %p timeo %ld", sk, timeo);
830
831 /* Wait for an incoming connection. (wake-one). */
832 add_wait_queue_exclusive(sk_sleep(sk), &wait);
833 while (1) {
834 if (sk->sk_state != BT_LISTEN) {
835 err = -EBADFD;
836 break;
837 }
838
839 ch = bt_accept_dequeue(sk, newsock);
840 if (ch) {
841 /* Drop the bridging ref from bt_accept_dequeue();
842 * the grafted socket keeps ch alive from here.
843 */
844 sock_put(ch);
845 break;
846 }
847
848 if (!timeo) {
849 err = -EAGAIN;
850 break;
851 }
852
853 if (signal_pending(current)) {
854 err = sock_intr_errno(timeo);
855 break;
856 }
857
858 release_sock(sk);
859
860 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
861 lock_sock(sk);
862 }
863 remove_wait_queue(sk_sleep(sk), &wait);
864
865 if (err)
866 goto done;
867
868 newsock->state = SS_CONNECTED;
869
870 BT_DBG("new socket %p", ch);
871
872 done:
873 release_sock(sk);
874 return err;
875 }
876
sco_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)877 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
878 int peer)
879 {
880 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
881 struct sock *sk = sock->sk;
882
883 BT_DBG("sock %p, sk %p", sock, sk);
884
885 addr->sa_family = AF_BLUETOOTH;
886
887 if (peer)
888 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
889 else
890 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
891
892 return sizeof(struct sockaddr_sco);
893 }
894
sco_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)895 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
896 size_t len)
897 {
898 struct sock *sk = sock->sk;
899 struct sk_buff *skb;
900 struct sockcm_cookie sockc;
901 int err;
902
903 BT_DBG("sock %p, sk %p", sock, sk);
904
905 err = sock_error(sk);
906 if (err)
907 return err;
908
909 if (msg->msg_flags & MSG_OOB)
910 return -EOPNOTSUPP;
911
912 hci_sockcm_init(&sockc, sk);
913
914 if (msg->msg_controllen) {
915 err = sock_cmsg_send(sk, msg, &sockc);
916 if (err)
917 return err;
918 }
919
920 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
921 if (IS_ERR(skb))
922 return PTR_ERR(skb);
923
924 lock_sock(sk);
925
926 if (sk->sk_state == BT_CONNECTED)
927 err = sco_send_frame(sk, skb, &sockc);
928 else
929 err = -ENOTCONN;
930
931 release_sock(sk);
932
933 if (err < 0)
934 kfree_skb(skb);
935 return err;
936 }
937
sco_conn_defer_accept(struct hci_conn * conn,u16 setting)938 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
939 {
940 struct hci_dev *hdev = conn->hdev;
941
942 BT_DBG("conn %p", conn);
943
944 conn->state = BT_CONFIG;
945
946 if (!lmp_esco_capable(hdev)) {
947 struct hci_cp_accept_conn_req cp;
948
949 bacpy(&cp.bdaddr, &conn->dst);
950 cp.role = 0x00; /* Ignored */
951
952 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
953 } else {
954 struct hci_cp_accept_sync_conn_req cp;
955
956 bacpy(&cp.bdaddr, &conn->dst);
957 cp.pkt_type = cpu_to_le16(conn->pkt_type);
958
959 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
960 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
961 cp.content_format = cpu_to_le16(setting);
962
963 switch (setting & SCO_AIRMODE_MASK) {
964 case SCO_AIRMODE_TRANSP:
965 if (conn->pkt_type & ESCO_2EV3)
966 cp.max_latency = cpu_to_le16(0x0008);
967 else
968 cp.max_latency = cpu_to_le16(0x000D);
969 cp.retrans_effort = 0x02;
970 break;
971 case SCO_AIRMODE_CVSD:
972 cp.max_latency = cpu_to_le16(0xffff);
973 cp.retrans_effort = 0xff;
974 break;
975 default:
976 /* use CVSD settings as fallback */
977 cp.max_latency = cpu_to_le16(0xffff);
978 cp.retrans_effort = 0xff;
979 break;
980 }
981
982 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
983 sizeof(cp), &cp);
984 }
985 }
986
sco_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)987 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
988 size_t len, int flags)
989 {
990 struct sock *sk = sock->sk;
991 struct sco_pinfo *pi = sco_pi(sk);
992
993 if (unlikely(flags & MSG_ERRQUEUE))
994 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
995 BT_SCM_ERROR);
996
997 lock_sock(sk);
998
999 if (sk->sk_state == BT_CONNECT2 &&
1000 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
1001 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
1002 sk->sk_state = BT_CONFIG;
1003
1004 release_sock(sk);
1005 return 0;
1006 }
1007
1008 release_sock(sk);
1009
1010 return bt_sock_recvmsg(sock, msg, len, flags);
1011 }
1012
sco_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)1013 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
1014 sockptr_t optval, unsigned int optlen)
1015 {
1016 struct sock *sk = sock->sk;
1017 int err = 0;
1018 struct bt_voice voice;
1019 u32 opt;
1020 struct bt_codecs *codecs;
1021 struct hci_dev *hdev;
1022 __u8 buffer[255];
1023
1024 BT_DBG("sk %p", sk);
1025
1026 lock_sock(sk);
1027
1028 switch (optname) {
1029
1030 case BT_DEFER_SETUP:
1031 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1032 err = -EINVAL;
1033 break;
1034 }
1035
1036 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1037 if (err)
1038 break;
1039
1040 if (opt)
1041 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1042 else
1043 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1044 break;
1045
1046 case BT_VOICE:
1047 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1048 sk->sk_state != BT_CONNECT2) {
1049 err = -EINVAL;
1050 break;
1051 }
1052
1053 voice.setting = sco_pi(sk)->setting;
1054
1055 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval,
1056 optlen);
1057 if (err)
1058 break;
1059
1060 sco_pi(sk)->setting = voice.setting;
1061 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
1062 BDADDR_BREDR);
1063 if (!hdev) {
1064 err = -EBADFD;
1065 break;
1066 }
1067
1068 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
1069 case SCO_AIRMODE_TRANSP:
1070 if (enhanced_sync_conn_capable(hdev))
1071 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
1072 break;
1073 }
1074
1075 hci_dev_put(hdev);
1076 break;
1077
1078 case BT_PKT_STATUS:
1079 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1080 if (err)
1081 break;
1082
1083 if (opt)
1084 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1085 else
1086 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1087 break;
1088
1089 case BT_CODEC:
1090 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1091 sk->sk_state != BT_CONNECT2) {
1092 err = -EINVAL;
1093 break;
1094 }
1095
1096 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
1097 BDADDR_BREDR);
1098 if (!hdev) {
1099 err = -EBADFD;
1100 break;
1101 }
1102
1103 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1104 hci_dev_put(hdev);
1105 err = -EOPNOTSUPP;
1106 break;
1107 }
1108
1109 if (!hdev->get_data_path_id) {
1110 hci_dev_put(hdev);
1111 err = -EOPNOTSUPP;
1112 break;
1113 }
1114
1115 if (optlen < sizeof(struct bt_codecs) ||
1116 optlen > sizeof(buffer)) {
1117 hci_dev_put(hdev);
1118 err = -EINVAL;
1119 break;
1120 }
1121
1122 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval,
1123 optlen);
1124 if (err) {
1125 hci_dev_put(hdev);
1126 break;
1127 }
1128
1129 codecs = (void *)buffer;
1130
1131 if (codecs->num_codecs != 1 ||
1132 optlen < struct_size(codecs, codecs, codecs->num_codecs)) {
1133 hci_dev_put(hdev);
1134 err = -EINVAL;
1135 break;
1136 }
1137
1138 sco_pi(sk)->codec = codecs->codecs[0];
1139 hci_dev_put(hdev);
1140 break;
1141
1142 default:
1143 err = -ENOPROTOOPT;
1144 break;
1145 }
1146
1147 release_sock(sk);
1148 return err;
1149 }
1150
sco_sock_getsockopt_old(struct socket * sock,int optname,sockopt_t * opt)1151 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
1152 sockopt_t *opt)
1153 {
1154 struct sock *sk = sock->sk;
1155 struct sco_options opts;
1156 struct sco_conninfo cinfo;
1157 int err = 0;
1158 size_t len;
1159
1160 BT_DBG("sk %p", sk);
1161
1162 len = opt->optlen;
1163
1164 lock_sock(sk);
1165
1166 switch (optname) {
1167 case SCO_OPTIONS:
1168 if (sk->sk_state != BT_CONNECTED &&
1169 !(sk->sk_state == BT_CONNECT2 &&
1170 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1171 err = -ENOTCONN;
1172 break;
1173 }
1174
1175 opts.mtu = sco_pi(sk)->conn->mtu;
1176
1177 BT_DBG("mtu %u", opts.mtu);
1178
1179 len = min(len, sizeof(opts));
1180 if (copy_to_iter(&opts, len, &opt->iter_out) != len)
1181 err = -EFAULT;
1182
1183 break;
1184
1185 case SCO_CONNINFO:
1186 if (sk->sk_state != BT_CONNECTED &&
1187 !(sk->sk_state == BT_CONNECT2 &&
1188 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1189 err = -ENOTCONN;
1190 break;
1191 }
1192
1193 memset(&cinfo, 0, sizeof(cinfo));
1194 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1195 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1196
1197 len = min(len, sizeof(cinfo));
1198 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len)
1199 err = -EFAULT;
1200
1201 break;
1202
1203 default:
1204 err = -ENOPROTOOPT;
1205 break;
1206 }
1207
1208 release_sock(sk);
1209 return err;
1210 }
1211
sco_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * opt)1212 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1213 sockopt_t *opt)
1214 {
1215 struct sock *sk = sock->sk;
1216 int len, val, err = 0;
1217 struct bt_voice voice;
1218 u32 phys;
1219 int buf_len;
1220 struct codec_list *c;
1221 u8 num_codecs, i;
1222 struct hci_dev *hdev;
1223 struct hci_codec_caps *caps;
1224 struct bt_codec codec;
1225
1226 BT_DBG("sk %p", sk);
1227
1228 if (level == SOL_SCO)
1229 return sco_sock_getsockopt_old(sock, optname, opt);
1230
1231 len = opt->optlen;
1232
1233 lock_sock(sk);
1234
1235 switch (optname) {
1236
1237 case BT_DEFER_SETUP:
1238 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1239 err = -EINVAL;
1240 break;
1241 }
1242
1243 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1244 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1245 sizeof(val))
1246 err = -EFAULT;
1247
1248 break;
1249
1250 case BT_VOICE:
1251 voice.setting = sco_pi(sk)->setting;
1252
1253 len = min_t(unsigned int, len, sizeof(voice));
1254 if (copy_to_iter(&voice, len, &opt->iter_out) != len)
1255 err = -EFAULT;
1256
1257 break;
1258
1259 case BT_PHY:
1260 if (sk->sk_state != BT_CONNECTED) {
1261 err = -ENOTCONN;
1262 break;
1263 }
1264
1265 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1266
1267 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) !=
1268 sizeof(phys))
1269 err = -EFAULT;
1270 break;
1271
1272 case BT_PKT_STATUS:
1273 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1274 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1275 sizeof(val))
1276 err = -EFAULT;
1277 break;
1278
1279 case BT_SNDMTU:
1280 case BT_RCVMTU:
1281 if (sk->sk_state != BT_CONNECTED) {
1282 err = -ENOTCONN;
1283 break;
1284 }
1285
1286 val = sco_pi(sk)->conn->mtu;
1287 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) !=
1288 sizeof(val))
1289 err = -EFAULT;
1290 break;
1291
1292 case BT_CODEC:
1293 num_codecs = 0;
1294 buf_len = 0;
1295
1296 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1297 if (!hdev) {
1298 err = -EBADFD;
1299 break;
1300 }
1301
1302 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1303 hci_dev_put(hdev);
1304 err = -EOPNOTSUPP;
1305 break;
1306 }
1307
1308 if (!hdev->get_data_path_id) {
1309 hci_dev_put(hdev);
1310 err = -EOPNOTSUPP;
1311 break;
1312 }
1313
1314 release_sock(sk);
1315
1316 /* find total buffer size required to copy codec + caps */
1317 hci_dev_lock(hdev);
1318 list_for_each_entry(c, &hdev->local_codecs, list) {
1319 if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1320 continue;
1321 num_codecs++;
1322 for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1323 buf_len += 1 + caps->len;
1324 caps = (void *)&caps->data[caps->len];
1325 }
1326 buf_len += sizeof(struct bt_codec);
1327 }
1328 hci_dev_unlock(hdev);
1329
1330 buf_len += sizeof(struct bt_codecs);
1331 if (buf_len > len) {
1332 hci_dev_put(hdev);
1333 return -ENOBUFS;
1334 }
1335
1336 if (copy_to_iter(&num_codecs, sizeof(num_codecs),
1337 &opt->iter_out) != sizeof(num_codecs)) {
1338 hci_dev_put(hdev);
1339 return -EFAULT;
1340 }
1341
1342 /* Iterate all the codecs supported over SCO and populate
1343 * codec data
1344 */
1345 hci_dev_lock(hdev);
1346 list_for_each_entry(c, &hdev->local_codecs, list) {
1347 if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1348 continue;
1349
1350 codec.id = c->id;
1351 codec.cid = c->cid;
1352 codec.vid = c->vid;
1353 err = hdev->get_data_path_id(hdev, &codec.data_path);
1354 if (err < 0)
1355 break;
1356 codec.num_caps = c->num_caps;
1357 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out)
1358 != sizeof(codec)) {
1359 err = -EFAULT;
1360 break;
1361 }
1362
1363 /* find codec capabilities data length */
1364 len = 0;
1365 for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1366 len += 1 + caps->len;
1367 caps = (void *)&caps->data[caps->len];
1368 }
1369
1370 /* copy codec capabilities data */
1371 if (len &&
1372 copy_to_iter(c->caps, len, &opt->iter_out) != len) {
1373 err = -EFAULT;
1374 break;
1375 }
1376 }
1377
1378 hci_dev_unlock(hdev);
1379 hci_dev_put(hdev);
1380
1381 lock_sock(sk);
1382
1383 if (!err)
1384 opt->optlen = buf_len;
1385
1386 break;
1387
1388 default:
1389 err = -ENOPROTOOPT;
1390 break;
1391 }
1392
1393 release_sock(sk);
1394 return err;
1395 }
1396
sco_sock_shutdown(struct socket * sock,int how)1397 static int sco_sock_shutdown(struct socket *sock, int how)
1398 {
1399 struct sock *sk = sock->sk;
1400 int err = 0;
1401
1402 BT_DBG("sock %p, sk %p", sock, sk);
1403
1404 if (!sk)
1405 return 0;
1406
1407 sock_hold(sk);
1408 lock_sock(sk);
1409
1410 if (!sk->sk_shutdown) {
1411 sk->sk_shutdown = SHUTDOWN_MASK;
1412 sco_sock_clear_timer(sk);
1413 __sco_sock_close(sk);
1414
1415 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1416 !(current->flags & PF_EXITING))
1417 err = bt_sock_wait_state(sk, BT_CLOSED,
1418 sk->sk_lingertime);
1419 }
1420
1421 release_sock(sk);
1422 sock_put(sk);
1423
1424 return err;
1425 }
1426
sco_sock_release(struct socket * sock)1427 static int sco_sock_release(struct socket *sock)
1428 {
1429 struct sock *sk = sock->sk;
1430 int err = 0;
1431
1432 BT_DBG("sock %p, sk %p", sock, sk);
1433
1434 if (!sk)
1435 return 0;
1436
1437 sco_sock_close(sk);
1438
1439 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1440 !(current->flags & PF_EXITING)) {
1441 lock_sock(sk);
1442 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1443 release_sock(sk);
1444 }
1445
1446 sock_orphan(sk);
1447 sco_sock_kill(sk);
1448 return err;
1449 }
1450
sco_conn_ready(struct sco_conn * conn)1451 static void sco_conn_ready(struct sco_conn *conn)
1452 {
1453 struct sock *parent, *sk;
1454
1455 sco_conn_lock(conn);
1456 sk = sco_sock_hold(conn);
1457 sco_conn_unlock(conn);
1458
1459 BT_DBG("conn %p", conn);
1460
1461 if (sk) {
1462 lock_sock(sk);
1463
1464 /* conn->sk may have become NULL if racing with sk close, but
1465 * due to held hdev->lock, it can't become different sk.
1466 */
1467 if (conn->sk) {
1468 sco_sock_clear_timer(sk);
1469 sk->sk_state = BT_CONNECTED;
1470 sk->sk_state_change(sk);
1471 }
1472
1473 release_sock(sk);
1474 sock_put(sk);
1475 } else {
1476 if (!conn->hcon)
1477 return;
1478
1479 lockdep_assert_held(&conn->hcon->hdev->lock);
1480
1481 parent = sco_get_sock_listen(&conn->hcon->src);
1482 if (!parent)
1483 return;
1484
1485 lock_sock(parent);
1486
1487 sco_conn_lock(conn);
1488
1489 /* hdev->lock guarantees conn->sk == NULL still here */
1490
1491 if (parent->sk_state != BT_LISTEN)
1492 goto release;
1493
1494 sk = sco_sock_alloc(sock_net(parent), NULL,
1495 BTPROTO_SCO, GFP_ATOMIC, 0);
1496 if (!sk)
1497 goto release;
1498
1499 sco_sock_init(sk, parent);
1500
1501 bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1502 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1503
1504 __sco_chan_add(conn, sk, parent);
1505
1506 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1507 sk->sk_state = BT_CONNECT2;
1508 else
1509 sk->sk_state = BT_CONNECTED;
1510
1511 /* Wake up parent */
1512 parent->sk_data_ready(parent);
1513
1514 release:
1515 sco_conn_unlock(conn);
1516 release_sock(parent);
1517 sock_put(parent);
1518 }
1519 }
1520
1521 /* ----- SCO interface with lower layer (HCI) ----- */
sco_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr,__u8 * flags)1522 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1523 {
1524 struct sock *sk;
1525 int lm = 0;
1526
1527 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1528
1529 /* Find listening sockets */
1530 read_lock(&sco_sk_list.lock);
1531 sk_for_each(sk, &sco_sk_list.head) {
1532 if (sk->sk_state != BT_LISTEN)
1533 continue;
1534
1535 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1536 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1537 lm |= HCI_LM_ACCEPT;
1538
1539 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1540 *flags |= HCI_PROTO_DEFER;
1541 break;
1542 }
1543 }
1544 read_unlock(&sco_sk_list.lock);
1545
1546 return lm;
1547 }
1548
sco_connect_cfm(struct hci_conn * hcon,__u8 status)1549 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1550 {
1551 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1552 return;
1553
1554 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1555
1556 if (!status) {
1557 struct sco_conn *conn;
1558
1559 conn = sco_conn_add(hcon);
1560 if (conn) {
1561 sco_conn_ready(conn);
1562 sco_conn_put(conn);
1563 }
1564 } else
1565 sco_conn_del(hcon, bt_to_errno(status));
1566 }
1567
sco_disconn_cfm(struct hci_conn * hcon,__u8 reason)1568 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1569 {
1570 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1571 return;
1572
1573 BT_DBG("hcon %p reason %d", hcon, reason);
1574
1575 sco_conn_del(hcon, bt_to_errno(reason));
1576 }
1577
sco_recv_scodata(struct hci_dev * hdev,u16 handle,struct sk_buff * skb)1578 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb)
1579 {
1580 struct hci_conn *hcon;
1581 struct sco_conn *conn;
1582
1583 hci_dev_lock(hdev);
1584
1585 hcon = hci_conn_hash_lookup_handle(hdev, handle);
1586 if (!hcon) {
1587 hci_dev_unlock(hdev);
1588 kfree_skb(skb);
1589 return -ENOENT;
1590 }
1591
1592 conn = sco_conn_hold_unless_zero(hcon->sco_data);
1593 hcon = NULL;
1594
1595 hci_dev_unlock(hdev);
1596
1597 if (!conn) {
1598 kfree_skb(skb);
1599 return -EINVAL;
1600 }
1601
1602 BT_DBG("conn %p len %u", conn, skb->len);
1603
1604 if (skb->len)
1605 sco_recv_frame(conn, skb);
1606 else
1607 kfree_skb(skb);
1608
1609 sco_conn_put(conn);
1610 return 0;
1611 }
1612
1613 static struct hci_cb sco_cb = {
1614 .name = "SCO",
1615 .connect_cfm = sco_connect_cfm,
1616 .disconn_cfm = sco_disconn_cfm,
1617 };
1618
sco_debugfs_show(struct seq_file * f,void * p)1619 static int sco_debugfs_show(struct seq_file *f, void *p)
1620 {
1621 struct sock *sk;
1622
1623 read_lock(&sco_sk_list.lock);
1624
1625 sk_for_each(sk, &sco_sk_list.head) {
1626 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1627 &sco_pi(sk)->dst, sk->sk_state);
1628 }
1629
1630 read_unlock(&sco_sk_list.lock);
1631
1632 return 0;
1633 }
1634
1635 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1636
1637 static struct dentry *sco_debugfs;
1638
1639 static const struct proto_ops sco_sock_ops = {
1640 .family = PF_BLUETOOTH,
1641 .owner = THIS_MODULE,
1642 .release = sco_sock_release,
1643 .bind = sco_sock_bind,
1644 .connect = sco_sock_connect,
1645 .listen = sco_sock_listen,
1646 .accept = sco_sock_accept,
1647 .getname = sco_sock_getname,
1648 .sendmsg = sco_sock_sendmsg,
1649 .recvmsg = sco_sock_recvmsg,
1650 .poll = bt_sock_poll,
1651 .ioctl = bt_sock_ioctl,
1652 .gettstamp = sock_gettstamp,
1653 .mmap = sock_no_mmap,
1654 .socketpair = sock_no_socketpair,
1655 .shutdown = sco_sock_shutdown,
1656 .setsockopt = sco_sock_setsockopt,
1657 .getsockopt_iter = sco_sock_getsockopt
1658 };
1659
1660 static const struct net_proto_family sco_sock_family_ops = {
1661 .family = PF_BLUETOOTH,
1662 .owner = THIS_MODULE,
1663 .create = sco_sock_create,
1664 };
1665
sco_init(void)1666 int __init sco_init(void)
1667 {
1668 int err;
1669
1670 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1671
1672 err = proto_register(&sco_proto, 0);
1673 if (err < 0)
1674 return err;
1675
1676 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1677 if (err < 0) {
1678 BT_ERR("SCO socket registration failed");
1679 goto error;
1680 }
1681
1682 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1683 if (err < 0) {
1684 BT_ERR("Failed to create SCO proc file");
1685 bt_sock_unregister(BTPROTO_SCO);
1686 goto error;
1687 }
1688
1689 BT_INFO("SCO socket layer initialized");
1690
1691 hci_register_cb(&sco_cb);
1692
1693 if (IS_ERR_OR_NULL(bt_debugfs))
1694 return 0;
1695
1696 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1697 NULL, &sco_debugfs_fops);
1698
1699 return 0;
1700
1701 error:
1702 proto_unregister(&sco_proto);
1703 return err;
1704 }
1705
sco_exit(void)1706 void sco_exit(void)
1707 {
1708 bt_procfs_cleanup(&init_net, "sco");
1709
1710 debugfs_remove(sco_debugfs);
1711
1712 hci_unregister_cb(&sco_cb);
1713
1714 bt_sock_unregister(BTPROTO_SCO);
1715
1716 proto_unregister(&sco_proto);
1717 }
1718
1719 module_param(disable_esco, bool, 0644);
1720 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1721