1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2000-2001 Qualcomm Incorporated
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth HCI sockets. */
23 #include <linux/compat.h>
24 #include <linux/export.h>
25 #include <linux/utsname.h>
26 #include <linux/sched.h>
27 #include <linux/uio.h>
28 #include <linux/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_mon.h>
33 #include <net/bluetooth/mgmt.h>
34
35 #include "mgmt_util.h"
36
37 static LIST_HEAD(mgmt_chan_list);
38 static DEFINE_MUTEX(mgmt_chan_list_lock);
39
40 static DEFINE_IDA(sock_cookie_ida);
41
42 static atomic_t monitor_promisc = ATOMIC_INIT(0);
43
44 /* ----- HCI socket interface ----- */
45
46 /* Socket info */
47 #define hci_pi(sk) ((struct hci_pinfo *) sk)
48
49 struct hci_pinfo {
50 struct bt_sock bt;
51 struct hci_dev *hdev;
52 struct hci_filter filter;
53 __u8 cmsg_mask;
54 unsigned short channel;
55 unsigned long flags;
56 __u32 cookie;
57 char comm[TASK_COMM_LEN];
58 __u16 mtu;
59 };
60
hci_hdev_from_sock(struct sock * sk)61 static struct hci_dev *hci_hdev_from_sock(struct sock *sk)
62 {
63 struct hci_dev *hdev = hci_pi(sk)->hdev;
64
65 if (!hdev)
66 return ERR_PTR(-EBADFD);
67 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
68 return ERR_PTR(-EPIPE);
69 return hdev;
70 }
71
hci_sock_set_flag(struct sock * sk,int nr)72 void hci_sock_set_flag(struct sock *sk, int nr)
73 {
74 set_bit(nr, &hci_pi(sk)->flags);
75 }
76
hci_sock_clear_flag(struct sock * sk,int nr)77 void hci_sock_clear_flag(struct sock *sk, int nr)
78 {
79 clear_bit(nr, &hci_pi(sk)->flags);
80 }
81
hci_sock_test_flag(struct sock * sk,int nr)82 int hci_sock_test_flag(struct sock *sk, int nr)
83 {
84 return test_bit(nr, &hci_pi(sk)->flags);
85 }
86
hci_sock_get_channel(struct sock * sk)87 unsigned short hci_sock_get_channel(struct sock *sk)
88 {
89 return hci_pi(sk)->channel;
90 }
91
hci_sock_get_cookie(struct sock * sk)92 u32 hci_sock_get_cookie(struct sock *sk)
93 {
94 return hci_pi(sk)->cookie;
95 }
96
hci_sock_gen_cookie(struct sock * sk)97 static bool hci_sock_gen_cookie(struct sock *sk)
98 {
99 int id = hci_pi(sk)->cookie;
100
101 if (!id) {
102 id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL);
103 if (id < 0)
104 id = 0xffffffff;
105
106 hci_pi(sk)->cookie = id;
107 get_task_comm(hci_pi(sk)->comm, current);
108 return true;
109 }
110
111 return false;
112 }
113
hci_sock_free_cookie(struct sock * sk)114 static void hci_sock_free_cookie(struct sock *sk)
115 {
116 int id = hci_pi(sk)->cookie;
117
118 if (id) {
119 hci_pi(sk)->cookie = 0;
120 ida_free(&sock_cookie_ida, id);
121 }
122 }
123
hci_test_bit(int nr,const void * addr)124 static inline int hci_test_bit(int nr, const void *addr)
125 {
126 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
127 }
128
129 /* Security filter */
130 #define HCI_SFLT_MAX_OGF 5
131
132 struct hci_sec_filter {
133 __u32 type_mask;
134 __u32 event_mask[2];
135 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
136 };
137
138 static const struct hci_sec_filter hci_sec_filter = {
139 /* Packet types */
140 0x10,
141 /* Events */
142 { 0x1000d9fe, 0x0000b00c },
143 /* Commands */
144 {
145 { 0x0 },
146 /* OGF_LINK_CTL */
147 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
148 /* OGF_LINK_POLICY */
149 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
150 /* OGF_HOST_CTL */
151 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
152 /* OGF_INFO_PARAM */
153 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
154 /* OGF_STATUS_PARAM */
155 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
156 }
157 };
158
159 static struct bt_sock_list hci_sk_list = {
160 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
161 };
162
is_filtered_packet(struct sock * sk,struct sk_buff * skb)163 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
164 {
165 struct hci_filter *flt;
166 int flt_type, flt_event;
167 u8 event;
168
169 /* Apply filter */
170 flt = &hci_pi(sk)->filter;
171
172 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS;
173
174 if (!test_bit(flt_type, &flt->type_mask))
175 return true;
176
177 /* Extra filter for event packets only */
178 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT)
179 return false;
180
181 if (skb->len < 1)
182 return true;
183
184 event = *(__u8 *)skb->data;
185 flt_event = event & HCI_FLT_EVENT_BITS;
186
187 if (!hci_test_bit(flt_event, &flt->event_mask))
188 return true;
189
190 /* Check filter only when opcode is set */
191 if (!flt->opcode)
192 return false;
193
194 if (event == HCI_EV_CMD_COMPLETE && skb->len < 5)
195 return true;
196
197 if (event == HCI_EV_CMD_COMPLETE &&
198 flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
199 return true;
200
201 if (event == HCI_EV_CMD_STATUS && skb->len < 6)
202 return true;
203
204 if (event == HCI_EV_CMD_STATUS &&
205 flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
206 return true;
207
208 return false;
209 }
210
211 /* Send frame to RAW socket */
hci_send_to_sock(struct hci_dev * hdev,struct sk_buff * skb)212 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
213 {
214 struct sock *sk;
215 struct sk_buff *skb_copy = NULL;
216
217 BT_DBG("hdev %p len %d", hdev, skb->len);
218
219 read_lock(&hci_sk_list.lock);
220
221 sk_for_each(sk, &hci_sk_list.head) {
222 struct sk_buff *nskb;
223
224 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
225 continue;
226
227 /* Don't send frame to the socket it came from */
228 if (skb->sk == sk)
229 continue;
230
231 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
232 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
233 hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
234 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
235 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
236 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT)
237 continue;
238 if (is_filtered_packet(sk, skb))
239 continue;
240 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
241 if (!bt_cb(skb)->incoming)
242 continue;
243 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
244 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
245 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
246 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT &&
247 hci_skb_pkt_type(skb) != HCI_DRV_PKT)
248 continue;
249 } else {
250 /* Don't send frame to other channel types */
251 continue;
252 }
253
254 if (!skb_copy) {
255 /* Create a private copy with headroom */
256 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
257 if (!skb_copy)
258 continue;
259
260 /* Put type byte before the data */
261 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1);
262 }
263
264 nskb = skb_clone(skb_copy, GFP_ATOMIC);
265 if (!nskb)
266 continue;
267
268 if (sock_queue_rcv_skb(sk, nskb))
269 kfree_skb(nskb);
270 }
271
272 read_unlock(&hci_sk_list.lock);
273
274 kfree_skb(skb_copy);
275 }
276
hci_sock_copy_creds(struct sock * sk,struct sk_buff * skb)277 static void hci_sock_copy_creds(struct sock *sk, struct sk_buff *skb)
278 {
279 struct scm_creds *creds;
280
281 if (!sk || WARN_ON(!skb))
282 return;
283
284 creds = &bt_cb(skb)->creds;
285
286 /* Check if peer credentials is set */
287 if (!sk->sk_peer_pid) {
288 /* Check if parent peer credentials is set */
289 if (bt_sk(sk)->parent && bt_sk(sk)->parent->sk_peer_pid)
290 sk = bt_sk(sk)->parent;
291 else
292 return;
293 }
294
295 /* Check if scm_creds already set */
296 if (creds->pid == pid_vnr(sk->sk_peer_pid))
297 return;
298
299 memset(creds, 0, sizeof(*creds));
300
301 creds->pid = pid_vnr(sk->sk_peer_pid);
302 if (sk->sk_peer_cred) {
303 creds->uid = sk->sk_peer_cred->uid;
304 creds->gid = sk->sk_peer_cred->gid;
305 }
306 }
307
hci_skb_clone(struct sk_buff * skb)308 static struct sk_buff *hci_skb_clone(struct sk_buff *skb)
309 {
310 struct sk_buff *nskb;
311
312 if (!skb)
313 return NULL;
314
315 nskb = skb_clone(skb, GFP_ATOMIC);
316 if (!nskb)
317 return NULL;
318
319 hci_sock_copy_creds(skb->sk, nskb);
320
321 return nskb;
322 }
323
324 /* Send frame to sockets with specific channel */
__hci_send_to_channel(unsigned short channel,struct sk_buff * skb,int flag,struct sock * skip_sk)325 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
326 int flag, struct sock *skip_sk)
327 {
328 struct sock *sk;
329
330 BT_DBG("channel %u len %d", channel, skb->len);
331
332 sk_for_each(sk, &hci_sk_list.head) {
333 struct sk_buff *nskb;
334
335 /* Ignore socket without the flag set */
336 if (!hci_sock_test_flag(sk, flag))
337 continue;
338
339 /* Skip the original socket */
340 if (sk == skip_sk)
341 continue;
342
343 if (sk->sk_state != BT_BOUND)
344 continue;
345
346 if (hci_pi(sk)->channel != channel)
347 continue;
348
349 nskb = hci_skb_clone(skb);
350 if (!nskb)
351 continue;
352
353 if (sock_queue_rcv_skb(sk, nskb))
354 kfree_skb(nskb);
355 }
356
357 }
358
hci_send_to_channel(unsigned short channel,struct sk_buff * skb,int flag,struct sock * skip_sk)359 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
360 int flag, struct sock *skip_sk)
361 {
362 read_lock(&hci_sk_list.lock);
363 __hci_send_to_channel(channel, skb, flag, skip_sk);
364 read_unlock(&hci_sk_list.lock);
365 }
366
367 /* Send frame to monitor socket */
hci_send_to_monitor(struct hci_dev * hdev,struct sk_buff * skb)368 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
369 {
370 struct sk_buff *skb_copy = NULL;
371 struct hci_mon_hdr *hdr;
372 __le16 opcode;
373
374 if (!atomic_read(&monitor_promisc))
375 return;
376
377 BT_DBG("hdev %p len %d", hdev, skb->len);
378
379 switch (hci_skb_pkt_type(skb)) {
380 case HCI_COMMAND_PKT:
381 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
382 break;
383 case HCI_EVENT_PKT:
384 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
385 break;
386 case HCI_ACLDATA_PKT:
387 if (bt_cb(skb)->incoming)
388 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
389 else
390 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
391 break;
392 case HCI_SCODATA_PKT:
393 if (bt_cb(skb)->incoming)
394 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
395 else
396 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
397 break;
398 case HCI_ISODATA_PKT:
399 if (bt_cb(skb)->incoming)
400 opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT);
401 else
402 opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT);
403 break;
404 case HCI_DRV_PKT:
405 if (bt_cb(skb)->incoming)
406 opcode = cpu_to_le16(HCI_MON_DRV_RX_PKT);
407 else
408 opcode = cpu_to_le16(HCI_MON_DRV_TX_PKT);
409 break;
410 case HCI_DIAG_PKT:
411 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
412 break;
413 default:
414 return;
415 }
416
417 /* Create a private copy with headroom */
418 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
419 if (!skb_copy)
420 return;
421
422 hci_sock_copy_creds(skb->sk, skb_copy);
423
424 /* Put header before the data */
425 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE);
426 hdr->opcode = opcode;
427 hdr->index = cpu_to_le16(hdev->id);
428 hdr->len = cpu_to_le16(skb->len);
429
430 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
431 HCI_SOCK_TRUSTED, NULL);
432 kfree_skb(skb_copy);
433 }
434
hci_send_monitor_ctrl_event(struct hci_dev * hdev,u16 event,void * data,u16 data_len,ktime_t tstamp,int flag,struct sock * skip_sk)435 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
436 void *data, u16 data_len, ktime_t tstamp,
437 int flag, struct sock *skip_sk)
438 {
439 struct sock *sk;
440 __le16 index;
441
442 if (hdev)
443 index = cpu_to_le16(hdev->id);
444 else
445 index = cpu_to_le16(MGMT_INDEX_NONE);
446
447 read_lock(&hci_sk_list.lock);
448
449 sk_for_each(sk, &hci_sk_list.head) {
450 struct hci_mon_hdr *hdr;
451 struct sk_buff *skb;
452
453 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL)
454 continue;
455
456 /* Ignore socket without the flag set */
457 if (!hci_sock_test_flag(sk, flag))
458 continue;
459
460 /* Skip the original socket */
461 if (sk == skip_sk)
462 continue;
463
464 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC);
465 if (!skb)
466 continue;
467
468 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
469 put_unaligned_le16(event, skb_put(skb, 2));
470
471 if (data)
472 skb_put_data(skb, data, data_len);
473
474 skb->tstamp = tstamp;
475
476 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
477 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT);
478 hdr->index = index;
479 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
480
481 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
482 HCI_SOCK_TRUSTED, NULL);
483 kfree_skb(skb);
484 }
485
486 read_unlock(&hci_sk_list.lock);
487 }
488
create_monitor_event(struct hci_dev * hdev,int event)489 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
490 {
491 struct hci_mon_hdr *hdr;
492 struct hci_mon_new_index *ni;
493 struct hci_mon_index_info *ii;
494 struct sk_buff *skb;
495 __le16 opcode;
496
497 switch (event) {
498 case HCI_DEV_REG:
499 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
500 if (!skb)
501 return NULL;
502
503 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
504 ni->type = 0x00; /* Old hdev->dev_type */
505 ni->bus = hdev->bus;
506 bacpy(&ni->bdaddr, &hdev->bdaddr);
507 memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
508 strnlen(hdev->name, sizeof(ni->name)), '\0');
509
510 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
511 break;
512
513 case HCI_DEV_UNREG:
514 skb = bt_skb_alloc(0, GFP_ATOMIC);
515 if (!skb)
516 return NULL;
517
518 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
519 break;
520
521 case HCI_DEV_SETUP:
522 if (hdev->manufacturer == 0xffff)
523 return NULL;
524 fallthrough;
525
526 case HCI_DEV_UP:
527 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
528 if (!skb)
529 return NULL;
530
531 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE);
532 bacpy(&ii->bdaddr, &hdev->bdaddr);
533 ii->manufacturer = cpu_to_le16(hdev->manufacturer);
534
535 opcode = cpu_to_le16(HCI_MON_INDEX_INFO);
536 break;
537
538 case HCI_DEV_OPEN:
539 skb = bt_skb_alloc(0, GFP_ATOMIC);
540 if (!skb)
541 return NULL;
542
543 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX);
544 break;
545
546 case HCI_DEV_CLOSE:
547 skb = bt_skb_alloc(0, GFP_ATOMIC);
548 if (!skb)
549 return NULL;
550
551 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX);
552 break;
553
554 default:
555 return NULL;
556 }
557
558 __net_timestamp(skb);
559
560 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
561 hdr->opcode = opcode;
562 hdr->index = cpu_to_le16(hdev->id);
563 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
564
565 return skb;
566 }
567
create_monitor_ctrl_open(struct sock * sk)568 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk)
569 {
570 struct hci_mon_hdr *hdr;
571 struct sk_buff *skb;
572 u16 format;
573 u8 ver[3];
574 u32 flags;
575
576 /* No message needed when cookie is not present */
577 if (!hci_pi(sk)->cookie)
578 return NULL;
579
580 switch (hci_pi(sk)->channel) {
581 case HCI_CHANNEL_RAW:
582 format = 0x0000;
583 ver[0] = BT_SUBSYS_VERSION;
584 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
585 break;
586 case HCI_CHANNEL_USER:
587 format = 0x0001;
588 ver[0] = BT_SUBSYS_VERSION;
589 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
590 break;
591 case HCI_CHANNEL_CONTROL:
592 format = 0x0002;
593 mgmt_fill_version_info(ver);
594 break;
595 default:
596 /* No message for unsupported format */
597 return NULL;
598 }
599
600 skb = bt_skb_alloc(14 + TASK_COMM_LEN, GFP_ATOMIC);
601 if (!skb)
602 return NULL;
603
604 hci_sock_copy_creds(sk, skb);
605
606 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0;
607
608 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
609 put_unaligned_le16(format, skb_put(skb, 2));
610 skb_put_data(skb, ver, sizeof(ver));
611 put_unaligned_le32(flags, skb_put(skb, 4));
612 skb_put_u8(skb, TASK_COMM_LEN);
613 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN);
614
615 __net_timestamp(skb);
616
617 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
618 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN);
619 if (hci_pi(sk)->hdev)
620 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
621 else
622 hdr->index = cpu_to_le16(HCI_DEV_NONE);
623 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
624
625 return skb;
626 }
627
create_monitor_ctrl_close(struct sock * sk)628 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk)
629 {
630 struct hci_mon_hdr *hdr;
631 struct sk_buff *skb;
632
633 /* No message needed when cookie is not present */
634 if (!hci_pi(sk)->cookie)
635 return NULL;
636
637 switch (hci_pi(sk)->channel) {
638 case HCI_CHANNEL_RAW:
639 case HCI_CHANNEL_USER:
640 case HCI_CHANNEL_CONTROL:
641 break;
642 default:
643 /* No message for unsupported format */
644 return NULL;
645 }
646
647 skb = bt_skb_alloc(4, GFP_ATOMIC);
648 if (!skb)
649 return NULL;
650
651 hci_sock_copy_creds(sk, skb);
652
653 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
654
655 __net_timestamp(skb);
656
657 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
658 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE);
659 if (hci_pi(sk)->hdev)
660 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
661 else
662 hdr->index = cpu_to_le16(HCI_DEV_NONE);
663 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
664
665 return skb;
666 }
667
create_monitor_ctrl_command(struct sock * sk,u16 index,u16 opcode,u16 len,const void * buf)668 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index,
669 u16 opcode, u16 len,
670 const void *buf)
671 {
672 struct hci_mon_hdr *hdr;
673 struct sk_buff *skb;
674
675 skb = bt_skb_alloc(6 + len, GFP_ATOMIC);
676 if (!skb)
677 return NULL;
678
679 hci_sock_copy_creds(sk, skb);
680
681 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
682 put_unaligned_le16(opcode, skb_put(skb, 2));
683
684 if (buf)
685 skb_put_data(skb, buf, len);
686
687 __net_timestamp(skb);
688
689 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
690 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND);
691 hdr->index = cpu_to_le16(index);
692 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
693
694 return skb;
695 }
696
697 static void __printf(2, 3)
send_monitor_note(struct sock * sk,const char * fmt,...)698 send_monitor_note(struct sock *sk, const char *fmt, ...)
699 {
700 size_t len;
701 struct hci_mon_hdr *hdr;
702 struct sk_buff *skb;
703 va_list args;
704
705 va_start(args, fmt);
706 len = vsnprintf(NULL, 0, fmt, args);
707 va_end(args);
708
709 skb = bt_skb_alloc(len + 1, GFP_ATOMIC);
710 if (!skb)
711 return;
712
713 hci_sock_copy_creds(sk, skb);
714
715 va_start(args, fmt);
716 vsprintf(skb_put(skb, len), fmt, args);
717 *(u8 *)skb_put(skb, 1) = 0;
718 va_end(args);
719
720 __net_timestamp(skb);
721
722 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE);
723 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE);
724 hdr->index = cpu_to_le16(HCI_DEV_NONE);
725 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
726
727 if (sock_queue_rcv_skb(sk, skb))
728 kfree_skb(skb);
729 }
730
send_monitor_replay(struct sock * sk)731 static void send_monitor_replay(struct sock *sk)
732 {
733 struct hci_dev *hdev;
734
735 read_lock(&hci_dev_list_lock);
736
737 list_for_each_entry(hdev, &hci_dev_list, list) {
738 struct sk_buff *skb;
739
740 skb = create_monitor_event(hdev, HCI_DEV_REG);
741 if (!skb)
742 continue;
743
744 if (sock_queue_rcv_skb(sk, skb))
745 kfree_skb(skb);
746
747 if (!test_bit(HCI_RUNNING, &hdev->flags))
748 continue;
749
750 skb = create_monitor_event(hdev, HCI_DEV_OPEN);
751 if (!skb)
752 continue;
753
754 if (sock_queue_rcv_skb(sk, skb))
755 kfree_skb(skb);
756
757 if (test_bit(HCI_UP, &hdev->flags))
758 skb = create_monitor_event(hdev, HCI_DEV_UP);
759 else if (hci_dev_test_flag(hdev, HCI_SETUP))
760 skb = create_monitor_event(hdev, HCI_DEV_SETUP);
761 else
762 skb = NULL;
763
764 if (skb) {
765 if (sock_queue_rcv_skb(sk, skb))
766 kfree_skb(skb);
767 }
768 }
769
770 read_unlock(&hci_dev_list_lock);
771 }
772
send_monitor_control_replay(struct sock * mon_sk)773 static void send_monitor_control_replay(struct sock *mon_sk)
774 {
775 struct sock *sk;
776
777 read_lock(&hci_sk_list.lock);
778
779 sk_for_each(sk, &hci_sk_list.head) {
780 struct sk_buff *skb;
781
782 skb = create_monitor_ctrl_open(sk);
783 if (!skb)
784 continue;
785
786 if (sock_queue_rcv_skb(mon_sk, skb))
787 kfree_skb(skb);
788 }
789
790 read_unlock(&hci_sk_list.lock);
791 }
792
793 /* Generate internal stack event */
hci_si_event(struct hci_dev * hdev,int type,int dlen,void * data)794 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
795 {
796 struct hci_event_hdr *hdr;
797 struct hci_ev_stack_internal *ev;
798 struct sk_buff *skb;
799
800 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
801 if (!skb)
802 return;
803
804 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE);
805 hdr->evt = HCI_EV_STACK_INTERNAL;
806 hdr->plen = sizeof(*ev) + dlen;
807
808 ev = skb_put(skb, sizeof(*ev) + dlen);
809 ev->type = type;
810 memcpy(ev->data, data, dlen);
811
812 bt_cb(skb)->incoming = 1;
813 __net_timestamp(skb);
814
815 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
816 hci_send_to_sock(hdev, skb);
817 kfree_skb(skb);
818 }
819
hci_sock_dev_event(struct hci_dev * hdev,int event)820 void hci_sock_dev_event(struct hci_dev *hdev, int event)
821 {
822 BT_DBG("hdev %s event %d", hdev->name, event);
823
824 if (atomic_read(&monitor_promisc)) {
825 struct sk_buff *skb;
826
827 /* Send event to monitor */
828 skb = create_monitor_event(hdev, event);
829 if (skb) {
830 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
831 HCI_SOCK_TRUSTED, NULL);
832 kfree_skb(skb);
833 }
834 }
835
836 if (event <= HCI_DEV_DOWN) {
837 struct hci_ev_si_device ev;
838
839 /* Send event to sockets */
840 ev.event = event;
841 ev.dev_id = hdev->id;
842 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
843 }
844
845 if (event == HCI_DEV_UNREG) {
846 struct sock *sk;
847
848 /* Wake up sockets using this dead device */
849 read_lock(&hci_sk_list.lock);
850 sk_for_each(sk, &hci_sk_list.head) {
851 if (hci_pi(sk)->hdev == hdev) {
852 sk->sk_err = EPIPE;
853 sk->sk_state_change(sk);
854 }
855 }
856 read_unlock(&hci_sk_list.lock);
857 }
858 }
859
__hci_mgmt_chan_find(unsigned short channel)860 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
861 {
862 struct hci_mgmt_chan *c;
863
864 list_for_each_entry(c, &mgmt_chan_list, list) {
865 if (c->channel == channel)
866 return c;
867 }
868
869 return NULL;
870 }
871
hci_mgmt_chan_find(unsigned short channel)872 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
873 {
874 struct hci_mgmt_chan *c;
875
876 mutex_lock(&mgmt_chan_list_lock);
877 c = __hci_mgmt_chan_find(channel);
878 mutex_unlock(&mgmt_chan_list_lock);
879
880 return c;
881 }
882
hci_mgmt_chan_register(struct hci_mgmt_chan * c)883 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
884 {
885 if (c->channel < HCI_CHANNEL_CONTROL)
886 return -EINVAL;
887
888 mutex_lock(&mgmt_chan_list_lock);
889 if (__hci_mgmt_chan_find(c->channel)) {
890 mutex_unlock(&mgmt_chan_list_lock);
891 return -EALREADY;
892 }
893
894 list_add_tail(&c->list, &mgmt_chan_list);
895
896 mutex_unlock(&mgmt_chan_list_lock);
897
898 return 0;
899 }
900 EXPORT_SYMBOL(hci_mgmt_chan_register);
901
hci_mgmt_chan_unregister(struct hci_mgmt_chan * c)902 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
903 {
904 mutex_lock(&mgmt_chan_list_lock);
905 list_del(&c->list);
906 mutex_unlock(&mgmt_chan_list_lock);
907 }
908 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
909
hci_sock_release(struct socket * sock)910 static int hci_sock_release(struct socket *sock)
911 {
912 struct sock *sk = sock->sk;
913 struct hci_dev *hdev;
914 struct sk_buff *skb;
915
916 BT_DBG("sock %p sk %p", sock, sk);
917
918 if (!sk)
919 return 0;
920
921 lock_sock(sk);
922
923 switch (hci_pi(sk)->channel) {
924 case HCI_CHANNEL_MONITOR:
925 atomic_dec(&monitor_promisc);
926 break;
927 case HCI_CHANNEL_RAW:
928 case HCI_CHANNEL_USER:
929 case HCI_CHANNEL_CONTROL:
930 /* Send event to monitor */
931 skb = create_monitor_ctrl_close(sk);
932 if (skb) {
933 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
934 HCI_SOCK_TRUSTED, NULL);
935 kfree_skb(skb);
936 }
937
938 hci_sock_free_cookie(sk);
939 break;
940 }
941
942 bt_sock_unlink(&hci_sk_list, sk);
943
944 hdev = hci_pi(sk)->hdev;
945 if (hdev) {
946 if (hci_pi(sk)->channel == HCI_CHANNEL_USER &&
947 !hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
948 /* When releasing a user channel exclusive access,
949 * call hci_dev_do_close directly instead of calling
950 * hci_dev_close to ensure the exclusive access will
951 * be released and the controller brought back down.
952 *
953 * The checking of HCI_AUTO_OFF is not needed in this
954 * case since it will have been cleared already when
955 * opening the user channel.
956 *
957 * Make sure to also check that we haven't already
958 * unregistered since all the cleanup will have already
959 * been complete and hdev will get released when we put
960 * below.
961 */
962 hci_dev_do_close(hdev);
963 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
964 mgmt_index_added(hdev);
965 }
966
967 atomic_dec(&hdev->promisc);
968 hci_dev_put(hdev);
969 }
970
971 sock_orphan(sk);
972 release_sock(sk);
973 sock_put(sk);
974 return 0;
975 }
976
hci_sock_reject_list_add(struct hci_dev * hdev,void __user * arg)977 static int hci_sock_reject_list_add(struct hci_dev *hdev, void __user *arg)
978 {
979 bdaddr_t bdaddr;
980 int err;
981
982 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
983 return -EFAULT;
984
985 hci_dev_lock(hdev);
986
987 err = hci_bdaddr_list_add(&hdev->reject_list, &bdaddr, BDADDR_BREDR);
988
989 hci_dev_unlock(hdev);
990
991 return err;
992 }
993
hci_sock_reject_list_del(struct hci_dev * hdev,void __user * arg)994 static int hci_sock_reject_list_del(struct hci_dev *hdev, void __user *arg)
995 {
996 bdaddr_t bdaddr;
997 int err;
998
999 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
1000 return -EFAULT;
1001
1002 hci_dev_lock(hdev);
1003
1004 err = hci_bdaddr_list_del(&hdev->reject_list, &bdaddr, BDADDR_BREDR);
1005
1006 hci_dev_unlock(hdev);
1007
1008 return err;
1009 }
1010
1011 /* Ioctls that require bound socket */
hci_sock_bound_ioctl(struct sock * sk,unsigned int cmd,unsigned long arg)1012 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
1013 unsigned long arg)
1014 {
1015 struct hci_dev *hdev = hci_hdev_from_sock(sk);
1016
1017 if (IS_ERR(hdev))
1018 return PTR_ERR(hdev);
1019
1020 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1021 return -EBUSY;
1022
1023 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1024 return -EOPNOTSUPP;
1025
1026 switch (cmd) {
1027 case HCISETRAW:
1028 if (!capable(CAP_NET_ADMIN))
1029 return -EPERM;
1030 return -EOPNOTSUPP;
1031
1032 case HCIGETCONNINFO:
1033 return hci_get_conn_info(hdev, (void __user *)arg);
1034
1035 case HCIGETAUTHINFO:
1036 return hci_get_auth_info(hdev, (void __user *)arg);
1037
1038 case HCIBLOCKADDR:
1039 if (!capable(CAP_NET_ADMIN))
1040 return -EPERM;
1041 return hci_sock_reject_list_add(hdev, (void __user *)arg);
1042
1043 case HCIUNBLOCKADDR:
1044 if (!capable(CAP_NET_ADMIN))
1045 return -EPERM;
1046 return hci_sock_reject_list_del(hdev, (void __user *)arg);
1047 }
1048
1049 return -ENOIOCTLCMD;
1050 }
1051
hci_sock_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1052 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
1053 unsigned long arg)
1054 {
1055 void __user *argp = (void __user *)arg;
1056 struct sock *sk = sock->sk;
1057 int err;
1058
1059 BT_DBG("cmd %x arg %lx", cmd, arg);
1060
1061 /* Make sure the cmd is valid before doing anything */
1062 switch (cmd) {
1063 case HCIGETDEVLIST:
1064 case HCIGETDEVINFO:
1065 case HCIGETCONNLIST:
1066 case HCIDEVUP:
1067 case HCIDEVDOWN:
1068 case HCIDEVRESET:
1069 case HCIDEVRESTAT:
1070 case HCISETSCAN:
1071 case HCISETAUTH:
1072 case HCISETENCRYPT:
1073 case HCISETPTYPE:
1074 case HCISETLINKPOL:
1075 case HCISETLINKMODE:
1076 case HCISETACLMTU:
1077 case HCISETSCOMTU:
1078 case HCIINQUIRY:
1079 case HCISETRAW:
1080 case HCIGETCONNINFO:
1081 case HCIGETAUTHINFO:
1082 case HCIBLOCKADDR:
1083 case HCIUNBLOCKADDR:
1084 break;
1085 default:
1086 return -ENOIOCTLCMD;
1087 }
1088
1089 lock_sock(sk);
1090
1091 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1092 err = -EBADFD;
1093 goto done;
1094 }
1095
1096 /* When calling an ioctl on an unbound raw socket, then ensure
1097 * that the monitor gets informed. Ensure that the resulting event
1098 * is only send once by checking if the cookie exists or not. The
1099 * socket cookie will be only ever generated once for the lifetime
1100 * of a given socket.
1101 */
1102 if (hci_sock_gen_cookie(sk)) {
1103 struct sk_buff *skb;
1104
1105 /* Perform careful checks before setting the HCI_SOCK_TRUSTED
1106 * flag. Make sure that not only the current task but also
1107 * the socket opener has the required capability, since
1108 * privileged programs can be tricked into making ioctl calls
1109 * on HCI sockets, and the socket should not be marked as
1110 * trusted simply because the ioctl caller is privileged.
1111 */
1112 if (sk_capable(sk, CAP_NET_ADMIN))
1113 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1114
1115 /* Send event to monitor */
1116 skb = create_monitor_ctrl_open(sk);
1117 if (skb) {
1118 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1119 HCI_SOCK_TRUSTED, NULL);
1120 kfree_skb(skb);
1121 }
1122 }
1123
1124 release_sock(sk);
1125
1126 switch (cmd) {
1127 case HCIGETDEVLIST:
1128 return hci_get_dev_list(argp);
1129
1130 case HCIGETDEVINFO:
1131 return hci_get_dev_info(argp);
1132
1133 case HCIGETCONNLIST:
1134 return hci_get_conn_list(argp);
1135
1136 case HCIDEVUP:
1137 if (!capable(CAP_NET_ADMIN))
1138 return -EPERM;
1139 return hci_dev_open(arg);
1140
1141 case HCIDEVDOWN:
1142 if (!capable(CAP_NET_ADMIN))
1143 return -EPERM;
1144 return hci_dev_close(arg);
1145
1146 case HCIDEVRESET:
1147 if (!capable(CAP_NET_ADMIN))
1148 return -EPERM;
1149 return hci_dev_reset(arg);
1150
1151 case HCIDEVRESTAT:
1152 if (!capable(CAP_NET_ADMIN))
1153 return -EPERM;
1154 return hci_dev_reset_stat(arg);
1155
1156 case HCISETSCAN:
1157 case HCISETAUTH:
1158 case HCISETENCRYPT:
1159 case HCISETPTYPE:
1160 case HCISETLINKPOL:
1161 case HCISETLINKMODE:
1162 case HCISETACLMTU:
1163 case HCISETSCOMTU:
1164 if (!capable(CAP_NET_ADMIN))
1165 return -EPERM;
1166 return hci_dev_cmd(cmd, argp);
1167
1168 case HCIINQUIRY:
1169 return hci_inquiry(argp);
1170 }
1171
1172 lock_sock(sk);
1173
1174 err = hci_sock_bound_ioctl(sk, cmd, arg);
1175
1176 done:
1177 release_sock(sk);
1178 return err;
1179 }
1180
1181 #ifdef CONFIG_COMPAT
hci_sock_compat_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1182 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd,
1183 unsigned long arg)
1184 {
1185 switch (cmd) {
1186 case HCIDEVUP:
1187 case HCIDEVDOWN:
1188 case HCIDEVRESET:
1189 case HCIDEVRESTAT:
1190 return hci_sock_ioctl(sock, cmd, arg);
1191 }
1192
1193 return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
1194 }
1195 #endif
1196
hci_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int addr_len)1197 static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
1198 int addr_len)
1199 {
1200 struct sockaddr_hci haddr;
1201 struct sock *sk = sock->sk;
1202 struct hci_dev *hdev = NULL;
1203 struct sk_buff *skb;
1204 int len, err = 0;
1205
1206 BT_DBG("sock %p sk %p", sock, sk);
1207
1208 if (!addr)
1209 return -EINVAL;
1210
1211 memset(&haddr, 0, sizeof(haddr));
1212 len = min_t(unsigned int, sizeof(haddr), addr_len);
1213 memcpy(&haddr, addr, len);
1214
1215 if (haddr.hci_family != AF_BLUETOOTH)
1216 return -EINVAL;
1217
1218 lock_sock(sk);
1219
1220 /* Allow detaching from dead device and attaching to alive device, if
1221 * the caller wants to re-bind (instead of close) this socket in
1222 * response to hci_sock_dev_event(HCI_DEV_UNREG) notification.
1223 */
1224 hdev = hci_pi(sk)->hdev;
1225 if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1226 hci_pi(sk)->hdev = NULL;
1227 sk->sk_state = BT_OPEN;
1228 hci_dev_put(hdev);
1229 }
1230 hdev = NULL;
1231
1232 if (sk->sk_state == BT_BOUND) {
1233 err = -EALREADY;
1234 goto done;
1235 }
1236
1237 switch (haddr.hci_channel) {
1238 case HCI_CHANNEL_RAW:
1239 if (hci_pi(sk)->hdev) {
1240 err = -EALREADY;
1241 goto done;
1242 }
1243
1244 if (haddr.hci_dev != HCI_DEV_NONE) {
1245 hdev = hci_dev_get(haddr.hci_dev);
1246 if (!hdev) {
1247 err = -ENODEV;
1248 goto done;
1249 }
1250
1251 atomic_inc(&hdev->promisc);
1252 }
1253
1254 hci_pi(sk)->channel = haddr.hci_channel;
1255
1256 if (!hci_sock_gen_cookie(sk)) {
1257 /* In the case when a cookie has already been assigned,
1258 * then there has been already an ioctl issued against
1259 * an unbound socket and with that triggered an open
1260 * notification. Send a close notification first to
1261 * allow the state transition to bounded.
1262 */
1263 skb = create_monitor_ctrl_close(sk);
1264 if (skb) {
1265 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1266 HCI_SOCK_TRUSTED, NULL);
1267 kfree_skb(skb);
1268 }
1269 }
1270
1271 if (capable(CAP_NET_ADMIN))
1272 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1273
1274 hci_pi(sk)->hdev = hdev;
1275
1276 /* Send event to monitor */
1277 skb = create_monitor_ctrl_open(sk);
1278 if (skb) {
1279 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1280 HCI_SOCK_TRUSTED, NULL);
1281 kfree_skb(skb);
1282 }
1283 break;
1284
1285 case HCI_CHANNEL_USER:
1286 if (hci_pi(sk)->hdev) {
1287 err = -EALREADY;
1288 goto done;
1289 }
1290
1291 if (haddr.hci_dev == HCI_DEV_NONE) {
1292 err = -EINVAL;
1293 goto done;
1294 }
1295
1296 if (!capable(CAP_NET_ADMIN)) {
1297 err = -EPERM;
1298 goto done;
1299 }
1300
1301 hdev = hci_dev_get(haddr.hci_dev);
1302 if (!hdev) {
1303 err = -ENODEV;
1304 goto done;
1305 }
1306
1307 if (test_bit(HCI_INIT, &hdev->flags) ||
1308 hci_dev_test_flag(hdev, HCI_SETUP) ||
1309 hci_dev_test_flag(hdev, HCI_CONFIG) ||
1310 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1311 test_bit(HCI_UP, &hdev->flags))) {
1312 err = -EBUSY;
1313 hci_dev_put(hdev);
1314 goto done;
1315 }
1316
1317 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
1318 err = -EUSERS;
1319 hci_dev_put(hdev);
1320 goto done;
1321 }
1322
1323 hci_dev_lock(hdev);
1324 mgmt_index_removed(hdev);
1325 hci_dev_unlock(hdev);
1326
1327 err = hci_dev_open(hdev->id);
1328 if (err) {
1329 if (err == -EALREADY) {
1330 /* In case the transport is already up and
1331 * running, clear the error here.
1332 *
1333 * This can happen when opening a user
1334 * channel and HCI_AUTO_OFF grace period
1335 * is still active.
1336 */
1337 err = 0;
1338 } else {
1339 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
1340 mgmt_index_added(hdev);
1341 hci_dev_put(hdev);
1342 goto done;
1343 }
1344 }
1345
1346 hci_pi(sk)->channel = haddr.hci_channel;
1347
1348 if (!hci_sock_gen_cookie(sk)) {
1349 /* In the case when a cookie has already been assigned,
1350 * this socket will transition from a raw socket into
1351 * a user channel socket. For a clean transition, send
1352 * the close notification first.
1353 */
1354 skb = create_monitor_ctrl_close(sk);
1355 if (skb) {
1356 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1357 HCI_SOCK_TRUSTED, NULL);
1358 kfree_skb(skb);
1359 }
1360 }
1361
1362 /* The user channel is restricted to CAP_NET_ADMIN
1363 * capabilities and with that implicitly trusted.
1364 */
1365 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1366
1367 hci_pi(sk)->hdev = hdev;
1368
1369 /* Send event to monitor */
1370 skb = create_monitor_ctrl_open(sk);
1371 if (skb) {
1372 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1373 HCI_SOCK_TRUSTED, NULL);
1374 kfree_skb(skb);
1375 }
1376
1377 atomic_inc(&hdev->promisc);
1378 break;
1379
1380 case HCI_CHANNEL_MONITOR:
1381 if (haddr.hci_dev != HCI_DEV_NONE) {
1382 err = -EINVAL;
1383 goto done;
1384 }
1385
1386 if (!capable(CAP_NET_RAW)) {
1387 err = -EPERM;
1388 goto done;
1389 }
1390
1391 hci_pi(sk)->channel = haddr.hci_channel;
1392
1393 /* The monitor interface is restricted to CAP_NET_RAW
1394 * capabilities and with that implicitly trusted.
1395 */
1396 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1397
1398 send_monitor_note(sk, "Linux version %s (%s)",
1399 init_utsname()->release,
1400 init_utsname()->machine);
1401 send_monitor_note(sk, "Bluetooth subsystem version %u.%u",
1402 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION);
1403 send_monitor_replay(sk);
1404 send_monitor_control_replay(sk);
1405
1406 atomic_inc(&monitor_promisc);
1407 break;
1408
1409 case HCI_CHANNEL_LOGGING:
1410 if (haddr.hci_dev != HCI_DEV_NONE) {
1411 err = -EINVAL;
1412 goto done;
1413 }
1414
1415 if (!capable(CAP_NET_ADMIN)) {
1416 err = -EPERM;
1417 goto done;
1418 }
1419
1420 hci_pi(sk)->channel = haddr.hci_channel;
1421 break;
1422
1423 default:
1424 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
1425 err = -EINVAL;
1426 goto done;
1427 }
1428
1429 if (haddr.hci_dev != HCI_DEV_NONE) {
1430 err = -EINVAL;
1431 goto done;
1432 }
1433
1434 /* Users with CAP_NET_ADMIN capabilities are allowed
1435 * access to all management commands and events. For
1436 * untrusted users the interface is restricted and
1437 * also only untrusted events are sent.
1438 */
1439 if (capable(CAP_NET_ADMIN))
1440 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1441
1442 hci_pi(sk)->channel = haddr.hci_channel;
1443
1444 /* At the moment the index and unconfigured index events
1445 * are enabled unconditionally. Setting them on each
1446 * socket when binding keeps this functionality. They
1447 * however might be cleared later and then sending of these
1448 * events will be disabled, but that is then intentional.
1449 *
1450 * This also enables generic events that are safe to be
1451 * received by untrusted users. Example for such events
1452 * are changes to settings, class of device, name etc.
1453 */
1454 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) {
1455 if (!hci_sock_gen_cookie(sk)) {
1456 /* In the case when a cookie has already been
1457 * assigned, this socket will transition from
1458 * a raw socket into a control socket. To
1459 * allow for a clean transition, send the
1460 * close notification first.
1461 */
1462 skb = create_monitor_ctrl_close(sk);
1463 if (skb) {
1464 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1465 HCI_SOCK_TRUSTED, NULL);
1466 kfree_skb(skb);
1467 }
1468 }
1469
1470 /* Send event to monitor */
1471 skb = create_monitor_ctrl_open(sk);
1472 if (skb) {
1473 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1474 HCI_SOCK_TRUSTED, NULL);
1475 kfree_skb(skb);
1476 }
1477
1478 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
1479 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
1480 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS);
1481 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS);
1482 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1483 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1484 }
1485 break;
1486 }
1487
1488 /* Default MTU to HCI_MAX_FRAME_SIZE if not set */
1489 if (!hci_pi(sk)->mtu)
1490 hci_pi(sk)->mtu = HCI_MAX_FRAME_SIZE;
1491
1492 sk->sk_state = BT_BOUND;
1493
1494 done:
1495 release_sock(sk);
1496 return err;
1497 }
1498
hci_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)1499 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
1500 int peer)
1501 {
1502 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr;
1503 struct sock *sk = sock->sk;
1504 struct hci_dev *hdev;
1505 int err = 0;
1506
1507 BT_DBG("sock %p sk %p", sock, sk);
1508
1509 if (peer)
1510 return -EOPNOTSUPP;
1511
1512 lock_sock(sk);
1513
1514 hdev = hci_hdev_from_sock(sk);
1515 if (IS_ERR(hdev)) {
1516 err = PTR_ERR(hdev);
1517 goto done;
1518 }
1519
1520 haddr->hci_family = AF_BLUETOOTH;
1521 haddr->hci_dev = hdev->id;
1522 haddr->hci_channel= hci_pi(sk)->channel;
1523 err = sizeof(*haddr);
1524
1525 done:
1526 release_sock(sk);
1527 return err;
1528 }
1529
hci_sock_cmsg(struct sock * sk,struct msghdr * msg,struct sk_buff * skb)1530 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
1531 struct sk_buff *skb)
1532 {
1533 __u8 mask = hci_pi(sk)->cmsg_mask;
1534
1535 if (mask & HCI_CMSG_DIR) {
1536 int incoming = bt_cb(skb)->incoming;
1537 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
1538 &incoming);
1539 }
1540
1541 if (mask & HCI_CMSG_TSTAMP) {
1542 #ifdef CONFIG_COMPAT
1543 struct old_timeval32 ctv;
1544 #endif
1545 struct __kernel_old_timeval tv;
1546 void *data;
1547 int len;
1548
1549 skb_get_timestamp(skb, &tv);
1550
1551 data = &tv;
1552 len = sizeof(tv);
1553 #ifdef CONFIG_COMPAT
1554 if (!COMPAT_USE_64BIT_TIME &&
1555 (msg->msg_flags & MSG_CMSG_COMPAT)) {
1556 ctv.tv_sec = tv.tv_sec;
1557 ctv.tv_usec = tv.tv_usec;
1558 data = &ctv;
1559 len = sizeof(ctv);
1560 }
1561 #endif
1562
1563 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
1564 }
1565 }
1566
hci_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)1567 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1568 size_t len, int flags)
1569 {
1570 struct scm_cookie scm;
1571 struct sock *sk = sock->sk;
1572 struct sk_buff *skb;
1573 int copied, err;
1574 unsigned int skblen;
1575
1576 BT_DBG("sock %p, sk %p", sock, sk);
1577
1578 if (flags & MSG_OOB)
1579 return -EOPNOTSUPP;
1580
1581 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING)
1582 return -EOPNOTSUPP;
1583
1584 if (sk->sk_state == BT_CLOSED)
1585 return 0;
1586
1587 skb = skb_recv_datagram(sk, flags, &err);
1588 if (!skb)
1589 return err;
1590
1591 skblen = skb->len;
1592 copied = skb->len;
1593 if (len < copied) {
1594 msg->msg_flags |= MSG_TRUNC;
1595 copied = len;
1596 }
1597
1598 skb_reset_transport_header(skb);
1599 err = skb_copy_datagram_msg(skb, 0, msg, copied);
1600
1601 switch (hci_pi(sk)->channel) {
1602 case HCI_CHANNEL_RAW:
1603 hci_sock_cmsg(sk, msg, skb);
1604 break;
1605 case HCI_CHANNEL_USER:
1606 case HCI_CHANNEL_MONITOR:
1607 sock_recv_timestamp(msg, sk, skb);
1608 break;
1609 default:
1610 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
1611 sock_recv_timestamp(msg, sk, skb);
1612 break;
1613 }
1614
1615 memset(&scm, 0, sizeof(scm));
1616 scm.creds = bt_cb(skb)->creds;
1617
1618 skb_free_datagram(sk, skb);
1619
1620 if (flags & MSG_TRUNC)
1621 copied = skblen;
1622
1623 scm_recv(sock, msg, &scm, flags);
1624
1625 return err ? : copied;
1626 }
1627
hci_mgmt_cmd(struct hci_mgmt_chan * chan,struct sock * sk,struct sk_buff * skb)1628 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
1629 struct sk_buff *skb)
1630 {
1631 u8 *cp;
1632 struct mgmt_hdr *hdr;
1633 u16 opcode, index, len;
1634 struct hci_dev *hdev = NULL;
1635 const struct hci_mgmt_handler *handler;
1636 bool var_len, no_hdev;
1637 int err;
1638
1639 BT_DBG("got %d bytes", skb->len);
1640
1641 if (skb->len < sizeof(*hdr))
1642 return -EINVAL;
1643
1644 hdr = (void *)skb->data;
1645 opcode = __le16_to_cpu(hdr->opcode);
1646 index = __le16_to_cpu(hdr->index);
1647 len = __le16_to_cpu(hdr->len);
1648
1649 if (len != skb->len - sizeof(*hdr)) {
1650 err = -EINVAL;
1651 goto done;
1652 }
1653
1654 if (chan->channel == HCI_CHANNEL_CONTROL) {
1655 struct sk_buff *cmd;
1656
1657 /* Send event to monitor */
1658 cmd = create_monitor_ctrl_command(sk, index, opcode, len,
1659 skb->data + sizeof(*hdr));
1660 if (cmd) {
1661 hci_send_to_channel(HCI_CHANNEL_MONITOR, cmd,
1662 HCI_SOCK_TRUSTED, NULL);
1663 kfree_skb(cmd);
1664 }
1665 }
1666
1667 if (opcode >= chan->handler_count ||
1668 chan->handlers[opcode].func == NULL) {
1669 BT_DBG("Unknown op %u", opcode);
1670 err = mgmt_cmd_status(sk, index, opcode,
1671 MGMT_STATUS_UNKNOWN_COMMAND);
1672 goto done;
1673 }
1674
1675 handler = &chan->handlers[opcode];
1676
1677 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1678 !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1679 err = mgmt_cmd_status(sk, index, opcode,
1680 MGMT_STATUS_PERMISSION_DENIED);
1681 goto done;
1682 }
1683
1684 if (index != MGMT_INDEX_NONE) {
1685 hdev = hci_dev_get(index);
1686 if (!hdev) {
1687 err = mgmt_cmd_status(sk, index, opcode,
1688 MGMT_STATUS_INVALID_INDEX);
1689 goto done;
1690 }
1691
1692 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1693 hci_dev_test_flag(hdev, HCI_CONFIG) ||
1694 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1695 err = mgmt_cmd_status(sk, index, opcode,
1696 MGMT_STATUS_INVALID_INDEX);
1697 goto done;
1698 }
1699
1700 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1701 !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1702 err = mgmt_cmd_status(sk, index, opcode,
1703 MGMT_STATUS_INVALID_INDEX);
1704 goto done;
1705 }
1706 }
1707
1708 if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) {
1709 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1710 if (no_hdev != !hdev) {
1711 err = mgmt_cmd_status(sk, index, opcode,
1712 MGMT_STATUS_INVALID_INDEX);
1713 goto done;
1714 }
1715 }
1716
1717 var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1718 if ((var_len && len < handler->data_len) ||
1719 (!var_len && len != handler->data_len)) {
1720 err = mgmt_cmd_status(sk, index, opcode,
1721 MGMT_STATUS_INVALID_PARAMS);
1722 goto done;
1723 }
1724
1725 if (hdev && chan->hdev_init)
1726 chan->hdev_init(sk, hdev);
1727
1728 cp = skb->data + sizeof(*hdr);
1729
1730 err = handler->func(sk, hdev, cp, len);
1731 if (err < 0)
1732 goto done;
1733
1734 err = skb->len;
1735
1736 done:
1737 if (hdev)
1738 hci_dev_put(hdev);
1739
1740 return err;
1741 }
1742
hci_logging_frame(struct sock * sk,struct sk_buff * skb,unsigned int flags)1743 static int hci_logging_frame(struct sock *sk, struct sk_buff *skb,
1744 unsigned int flags)
1745 {
1746 struct hci_mon_hdr *hdr;
1747 struct hci_dev *hdev;
1748 u16 index;
1749 int err;
1750
1751 /* The logging frame consists at minimum of the standard header,
1752 * the priority byte, the ident length byte and at least one string
1753 * terminator NUL byte. Anything shorter are invalid packets.
1754 */
1755 if (skb->len < sizeof(*hdr) + 3)
1756 return -EINVAL;
1757
1758 hdr = (void *)skb->data;
1759
1760 if (__le16_to_cpu(hdr->len) != skb->len - sizeof(*hdr))
1761 return -EINVAL;
1762
1763 if (__le16_to_cpu(hdr->opcode) == 0x0000) {
1764 __u8 priority = skb->data[sizeof(*hdr)];
1765 __u8 ident_len = skb->data[sizeof(*hdr) + 1];
1766
1767 /* Only the priorities 0-7 are valid and with that any other
1768 * value results in an invalid packet.
1769 *
1770 * The priority byte is followed by an ident length byte and
1771 * the NUL terminated ident string. Check that the ident
1772 * length is not overflowing the packet and also that the
1773 * ident string itself is NUL terminated. In case the ident
1774 * length is zero, the length value actually doubles as NUL
1775 * terminator identifier.
1776 *
1777 * The message follows the ident string (if present) and
1778 * must be NUL terminated. Otherwise it is not a valid packet.
1779 */
1780 if (priority > 7 || skb->data[skb->len - 1] != 0x00 ||
1781 ident_len > skb->len - sizeof(*hdr) - 3 ||
1782 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00)
1783 return -EINVAL;
1784 } else {
1785 return -EINVAL;
1786 }
1787
1788 index = __le16_to_cpu(hdr->index);
1789
1790 if (index != MGMT_INDEX_NONE) {
1791 hdev = hci_dev_get(index);
1792 if (!hdev)
1793 return -ENODEV;
1794 } else {
1795 hdev = NULL;
1796 }
1797
1798 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING);
1799
1800 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL);
1801 err = skb->len;
1802
1803 if (hdev)
1804 hci_dev_put(hdev);
1805
1806 return err;
1807 }
1808
hci_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)1809 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1810 size_t len)
1811 {
1812 struct sock *sk = sock->sk;
1813 struct hci_mgmt_chan *chan;
1814 struct hci_dev *hdev;
1815 struct sk_buff *skb;
1816 int err;
1817 const unsigned int flags = msg->msg_flags;
1818
1819 BT_DBG("sock %p sk %p", sock, sk);
1820
1821 if (flags & MSG_OOB)
1822 return -EOPNOTSUPP;
1823
1824 if (flags & ~(MSG_DONTWAIT | MSG_NOSIGNAL | MSG_ERRQUEUE | MSG_CMSG_COMPAT))
1825 return -EINVAL;
1826
1827 if (len < 4 || len > hci_pi(sk)->mtu)
1828 return -EINVAL;
1829
1830 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
1831 if (IS_ERR(skb))
1832 return PTR_ERR(skb);
1833
1834 lock_sock(sk);
1835
1836 switch (hci_pi(sk)->channel) {
1837 case HCI_CHANNEL_RAW:
1838 case HCI_CHANNEL_USER:
1839 break;
1840 case HCI_CHANNEL_MONITOR:
1841 err = -EOPNOTSUPP;
1842 goto drop;
1843 case HCI_CHANNEL_LOGGING:
1844 err = hci_logging_frame(sk, skb, flags);
1845 goto drop;
1846 default:
1847 mutex_lock(&mgmt_chan_list_lock);
1848 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1849 if (chan)
1850 err = hci_mgmt_cmd(chan, sk, skb);
1851 else
1852 err = -EINVAL;
1853
1854 mutex_unlock(&mgmt_chan_list_lock);
1855 goto drop;
1856 }
1857
1858 hdev = hci_hdev_from_sock(sk);
1859 if (IS_ERR(hdev)) {
1860 err = PTR_ERR(hdev);
1861 goto drop;
1862 }
1863
1864 if (!test_bit(HCI_UP, &hdev->flags)) {
1865 err = -ENETDOWN;
1866 goto drop;
1867 }
1868
1869 hci_skb_pkt_type(skb) = skb->data[0];
1870 skb_pull(skb, 1);
1871
1872 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1873 /* No permission check is needed for user channel
1874 * since that gets enforced when binding the socket.
1875 *
1876 * However check that the packet type is valid.
1877 */
1878 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
1879 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1880 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1881 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT &&
1882 hci_skb_pkt_type(skb) != HCI_DRV_PKT) {
1883 err = -EINVAL;
1884 goto drop;
1885 }
1886
1887 skb_queue_tail(&hdev->raw_q, skb);
1888 queue_work(hdev->workqueue, &hdev->tx_work);
1889 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) {
1890 u16 opcode = get_unaligned_le16(skb->data);
1891 u16 ogf = hci_opcode_ogf(opcode);
1892 u16 ocf = hci_opcode_ocf(opcode);
1893
1894 if (((ogf > HCI_SFLT_MAX_OGF) ||
1895 (ocf > HCI_FLT_OCF_BITS) ||
1896 !hci_test_bit(ocf,
1897 &hci_sec_filter.ocf_mask[ogf])) &&
1898 !capable(CAP_NET_RAW)) {
1899 err = -EPERM;
1900 goto drop;
1901 }
1902
1903 /* Since the opcode has already been extracted here, store
1904 * a copy of the value for later use by the drivers.
1905 */
1906 hci_skb_opcode(skb) = opcode;
1907
1908 if (ogf == 0x3f) {
1909 skb_queue_tail(&hdev->raw_q, skb);
1910 queue_work(hdev->workqueue, &hdev->tx_work);
1911 } else {
1912 /* Stand-alone HCI commands must be flagged as
1913 * single-command requests.
1914 */
1915 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
1916
1917 skb_queue_tail(&hdev->cmd_q, skb);
1918 queue_work(hdev->workqueue, &hdev->cmd_work);
1919 }
1920 } else {
1921 if (!capable(CAP_NET_RAW)) {
1922 err = -EPERM;
1923 goto drop;
1924 }
1925
1926 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1927 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1928 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
1929 err = -EINVAL;
1930 goto drop;
1931 }
1932
1933 skb_queue_tail(&hdev->raw_q, skb);
1934 queue_work(hdev->workqueue, &hdev->tx_work);
1935 }
1936
1937 err = len;
1938
1939 done:
1940 release_sock(sk);
1941 return err;
1942
1943 drop:
1944 kfree_skb(skb);
1945 goto done;
1946 }
1947
hci_sock_setsockopt_old(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)1948 static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
1949 sockptr_t optval, unsigned int optlen)
1950 {
1951 struct hci_ufilter uf = { .opcode = 0 };
1952 struct sock *sk = sock->sk;
1953 int err = 0, opt = 0;
1954
1955 BT_DBG("sk %p, opt %d", sk, optname);
1956
1957 lock_sock(sk);
1958
1959 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1960 err = -EBADFD;
1961 goto done;
1962 }
1963
1964 switch (optname) {
1965 case HCI_DATA_DIR:
1966 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1967 if (err)
1968 break;
1969
1970 if (opt)
1971 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1972 else
1973 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1974 break;
1975
1976 case HCI_TIME_STAMP:
1977 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1978 if (err)
1979 break;
1980
1981 if (opt)
1982 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1983 else
1984 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1985 break;
1986
1987 case HCI_FILTER:
1988 {
1989 struct hci_filter *f = &hci_pi(sk)->filter;
1990
1991 uf.type_mask = f->type_mask;
1992 uf.opcode = f->opcode;
1993 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1994 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1995 }
1996
1997 err = copy_safe_from_sockptr(&uf, sizeof(uf), optval, optlen);
1998 if (err)
1999 break;
2000
2001 if (!capable(CAP_NET_RAW)) {
2002 uf.type_mask &= hci_sec_filter.type_mask;
2003 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
2004 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
2005 }
2006
2007 {
2008 struct hci_filter *f = &hci_pi(sk)->filter;
2009
2010 f->type_mask = uf.type_mask;
2011 f->opcode = uf.opcode;
2012 *((u32 *) f->event_mask + 0) = uf.event_mask[0];
2013 *((u32 *) f->event_mask + 1) = uf.event_mask[1];
2014 }
2015 break;
2016
2017 default:
2018 err = -ENOPROTOOPT;
2019 break;
2020 }
2021
2022 done:
2023 release_sock(sk);
2024 return err;
2025 }
2026
hci_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)2027 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
2028 sockptr_t optval, unsigned int optlen)
2029 {
2030 struct sock *sk = sock->sk;
2031 int err = 0;
2032 u16 opt;
2033
2034 BT_DBG("sk %p, opt %d", sk, optname);
2035
2036 if (level == SOL_HCI)
2037 return hci_sock_setsockopt_old(sock, level, optname, optval,
2038 optlen);
2039
2040 if (level != SOL_BLUETOOTH)
2041 return -ENOPROTOOPT;
2042
2043 lock_sock(sk);
2044
2045 switch (optname) {
2046 case BT_SNDMTU:
2047 case BT_RCVMTU:
2048 switch (hci_pi(sk)->channel) {
2049 /* Don't allow changing MTU for channels that are meant for HCI
2050 * traffic only.
2051 */
2052 case HCI_CHANNEL_RAW:
2053 case HCI_CHANNEL_USER:
2054 err = -ENOPROTOOPT;
2055 goto done;
2056 }
2057
2058 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
2059 if (err)
2060 break;
2061
2062 hci_pi(sk)->mtu = opt;
2063 break;
2064
2065 default:
2066 err = -ENOPROTOOPT;
2067 break;
2068 }
2069
2070 done:
2071 release_sock(sk);
2072 return err;
2073 }
2074
hci_sock_getsockopt_old(struct socket * sock,int level,int optname,sockopt_t * sopt)2075 static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname,
2076 sockopt_t *sopt)
2077 {
2078 struct hci_ufilter uf;
2079 struct sock *sk = sock->sk;
2080 int len, opt, err = 0;
2081
2082 BT_DBG("sk %p, opt %d", sk, optname);
2083
2084 len = sopt->optlen;
2085
2086 lock_sock(sk);
2087
2088 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
2089 err = -EBADFD;
2090 goto done;
2091 }
2092
2093 switch (optname) {
2094 case HCI_DATA_DIR:
2095 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
2096 opt = 1;
2097 else
2098 opt = 0;
2099
2100 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
2101 sizeof(opt))
2102 err = -EFAULT;
2103 break;
2104
2105 case HCI_TIME_STAMP:
2106 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
2107 opt = 1;
2108 else
2109 opt = 0;
2110
2111 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
2112 sizeof(opt))
2113 err = -EFAULT;
2114 break;
2115
2116 case HCI_FILTER:
2117 {
2118 struct hci_filter *f = &hci_pi(sk)->filter;
2119
2120 memset(&uf, 0, sizeof(uf));
2121 uf.type_mask = f->type_mask;
2122 uf.opcode = f->opcode;
2123 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
2124 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
2125 }
2126
2127 len = min_t(unsigned int, len, sizeof(uf));
2128 if (copy_to_iter(&uf, len, &sopt->iter_out) != len)
2129 err = -EFAULT;
2130 break;
2131
2132 default:
2133 err = -ENOPROTOOPT;
2134 break;
2135 }
2136
2137 done:
2138 release_sock(sk);
2139 return err;
2140 }
2141
hci_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * sopt)2142 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
2143 sockopt_t *sopt)
2144 {
2145 struct sock *sk = sock->sk;
2146 int err = 0;
2147 u16 mtu;
2148
2149 BT_DBG("sk %p, opt %d", sk, optname);
2150
2151 if (level == SOL_HCI)
2152 return hci_sock_getsockopt_old(sock, level, optname, sopt);
2153
2154 if (level != SOL_BLUETOOTH)
2155 return -ENOPROTOOPT;
2156
2157 lock_sock(sk);
2158
2159 switch (optname) {
2160 case BT_SNDMTU:
2161 case BT_RCVMTU:
2162 mtu = hci_pi(sk)->mtu;
2163 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
2164 sizeof(mtu))
2165 err = -EFAULT;
2166 break;
2167
2168 default:
2169 err = -ENOPROTOOPT;
2170 break;
2171 }
2172
2173 release_sock(sk);
2174 return err;
2175 }
2176
hci_sock_destruct(struct sock * sk)2177 static void hci_sock_destruct(struct sock *sk)
2178 {
2179 mgmt_cleanup(sk);
2180 skb_queue_purge(&sk->sk_receive_queue);
2181 skb_queue_purge(&sk->sk_write_queue);
2182 skb_queue_purge(&sk->sk_error_queue);
2183 }
2184
2185 static const struct proto_ops hci_sock_ops = {
2186 .family = PF_BLUETOOTH,
2187 .owner = THIS_MODULE,
2188 .release = hci_sock_release,
2189 .bind = hci_sock_bind,
2190 .getname = hci_sock_getname,
2191 .sendmsg = hci_sock_sendmsg,
2192 .recvmsg = hci_sock_recvmsg,
2193 .ioctl = hci_sock_ioctl,
2194 #ifdef CONFIG_COMPAT
2195 .compat_ioctl = hci_sock_compat_ioctl,
2196 #endif
2197 .poll = datagram_poll,
2198 .listen = sock_no_listen,
2199 .shutdown = sock_no_shutdown,
2200 .setsockopt = hci_sock_setsockopt,
2201 .getsockopt_iter = hci_sock_getsockopt,
2202 .connect = sock_no_connect,
2203 .socketpair = sock_no_socketpair,
2204 .accept = sock_no_accept,
2205 .mmap = sock_no_mmap
2206 };
2207
2208 static struct proto hci_sk_proto = {
2209 .name = "HCI",
2210 .owner = THIS_MODULE,
2211 .obj_size = sizeof(struct hci_pinfo)
2212 };
2213
hci_sock_create(struct net * net,struct socket * sock,int protocol,int kern)2214 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
2215 int kern)
2216 {
2217 struct sock *sk;
2218
2219 BT_DBG("sock %p", sock);
2220
2221 if (sock->type != SOCK_RAW)
2222 return -ESOCKTNOSUPPORT;
2223
2224 sock->ops = &hci_sock_ops;
2225
2226 sk = bt_sock_alloc(net, sock, &hci_sk_proto, protocol, GFP_ATOMIC,
2227 kern);
2228 if (!sk)
2229 return -ENOMEM;
2230
2231 sock->state = SS_UNCONNECTED;
2232 sk->sk_destruct = hci_sock_destruct;
2233
2234 bt_sock_link(&hci_sk_list, sk);
2235 return 0;
2236 }
2237
2238 static const struct net_proto_family hci_sock_family_ops = {
2239 .family = PF_BLUETOOTH,
2240 .owner = THIS_MODULE,
2241 .create = hci_sock_create,
2242 };
2243
hci_sock_init(void)2244 int __init hci_sock_init(void)
2245 {
2246 int err;
2247
2248 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
2249
2250 err = proto_register(&hci_sk_proto, 0);
2251 if (err < 0)
2252 return err;
2253
2254 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
2255 if (err < 0) {
2256 BT_ERR("HCI socket registration failed");
2257 goto error;
2258 }
2259
2260 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
2261 if (err < 0) {
2262 BT_ERR("Failed to create HCI proc file");
2263 bt_sock_unregister(BTPROTO_HCI);
2264 goto error;
2265 }
2266
2267 BT_INFO("HCI socket layer initialized");
2268
2269 return 0;
2270
2271 error:
2272 proto_unregister(&hci_sk_proto);
2273 return err;
2274 }
2275
hci_sock_cleanup(void)2276 void hci_sock_cleanup(void)
2277 {
2278 bt_procfs_cleanup(&init_net, "hci");
2279 bt_sock_unregister(BTPROTO_HCI);
2280 proto_unregister(&hci_sk_proto);
2281 }
2282