1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * RFCOMM sockets. 23 */ 24 #include <linux/compat.h> 25 #include <linux/export.h> 26 #include <linux/debugfs.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 static const struct proto_ops rfcomm_sock_ops; 36 37 static struct bt_sock_list rfcomm_sk_list = { 38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 39 }; 40 41 static void rfcomm_sock_close(struct sock *sk); 42 static void rfcomm_sock_kill(struct sock *sk); 43 44 /* ---- DLC callbacks ---- 45 * 46 * called under rfcomm_dlc_lock() 47 */ 48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 49 { 50 struct sock *sk = d->owner; 51 if (!sk) 52 return; 53 54 atomic_add(skb->len, &sk->sk_rmem_alloc); 55 skb_queue_tail(&sk->sk_receive_queue, skb); 56 sk->sk_data_ready(sk); 57 58 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 59 rfcomm_dlc_throttle(d); 60 } 61 62 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 63 __must_hold(&d->lock) 64 { 65 struct sock *sk = d->owner, *parent; 66 67 if (!sk) 68 return; 69 70 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 71 72 lock_sock(sk); 73 74 if (err) 75 sk->sk_err = err; 76 77 sk->sk_state = d->state; 78 79 parent = bt_sk(sk)->parent; 80 if (parent) { 81 if (d->state == BT_CLOSED) { 82 sock_set_flag(sk, SOCK_ZAPPED); 83 bt_accept_unlink(sk); 84 } 85 parent->sk_data_ready(parent); 86 } else { 87 if (d->state == BT_CONNECTED) 88 rfcomm_session_getaddr(d->session, 89 &rfcomm_pi(sk)->src, NULL); 90 sk->sk_state_change(sk); 91 } 92 93 release_sock(sk); 94 95 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 96 /* We have to drop DLC lock here, otherwise 97 * rfcomm_sock_destruct() will dead lock. */ 98 rfcomm_dlc_unlock(d); 99 rfcomm_sock_kill(sk); 100 rfcomm_dlc_lock(d); 101 } 102 } 103 104 /* ---- Socket functions ---- */ 105 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 106 { 107 struct sock *sk = NULL; 108 109 sk_for_each(sk, &rfcomm_sk_list.head) { 110 if (rfcomm_pi(sk)->channel != channel) 111 continue; 112 113 if (bacmp(&rfcomm_pi(sk)->src, src)) 114 continue; 115 116 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 117 break; 118 } 119 120 return sk ? sk : NULL; 121 } 122 123 /* Find socket with channel and source bdaddr. 124 * Returns closest match with an extra reference held. 125 */ 126 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 127 { 128 struct sock *sk = NULL, *sk1 = NULL; 129 130 read_lock(&rfcomm_sk_list.lock); 131 132 sk_for_each(sk, &rfcomm_sk_list.head) { 133 if (state && sk->sk_state != state) 134 continue; 135 136 if (rfcomm_pi(sk)->channel == channel) { 137 /* Exact match. */ 138 if (!bacmp(&rfcomm_pi(sk)->src, src)) { 139 sock_hold(sk); 140 break; 141 } 142 143 /* Closest match */ 144 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) { 145 if (sk1) 146 sock_put(sk1); 147 148 sk1 = sk; 149 sock_hold(sk1); 150 } 151 } 152 } 153 154 if (sk && sk1) 155 sock_put(sk1); 156 157 read_unlock(&rfcomm_sk_list.lock); 158 159 return sk ? sk : sk1; 160 } 161 162 static void rfcomm_sock_destruct(struct sock *sk) 163 { 164 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 165 166 BT_DBG("sk %p dlc %p", sk, d); 167 168 skb_queue_purge(&sk->sk_receive_queue); 169 skb_queue_purge(&sk->sk_write_queue); 170 171 rfcomm_dlc_lock(d); 172 rfcomm_pi(sk)->dlc = NULL; 173 174 /* Detach DLC if it's owned by this socket */ 175 if (d->owner == sk) 176 d->owner = NULL; 177 rfcomm_dlc_unlock(d); 178 179 rfcomm_dlc_put(d); 180 } 181 182 static void rfcomm_sock_cleanup_listen(struct sock *parent) 183 { 184 struct sock *sk; 185 186 BT_DBG("parent %p", parent); 187 188 /* Close not yet accepted dlcs */ 189 while ((sk = bt_accept_dequeue(parent, NULL))) { 190 rfcomm_sock_close(sk); 191 rfcomm_sock_kill(sk); 192 /* Drop the reference handed back by bt_accept_dequeue(). */ 193 sock_put(sk); 194 } 195 196 parent->sk_state = BT_CLOSED; 197 sock_set_flag(parent, SOCK_ZAPPED); 198 } 199 200 /* Kill socket (only if zapped and orphan) 201 * Must be called on unlocked socket. 202 */ 203 static void rfcomm_sock_kill(struct sock *sk) 204 { 205 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 206 return; 207 208 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 209 210 /* Kill poor orphan */ 211 bt_sock_unlink(&rfcomm_sk_list, sk); 212 sock_set_flag(sk, SOCK_DEAD); 213 sock_put(sk); 214 } 215 216 static void __rfcomm_sock_close(struct sock *sk) 217 { 218 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 219 220 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 221 222 switch (sk->sk_state) { 223 case BT_LISTEN: 224 rfcomm_sock_cleanup_listen(sk); 225 break; 226 227 case BT_CONNECT: 228 case BT_CONNECT2: 229 case BT_CONFIG: 230 case BT_CONNECTED: 231 rfcomm_dlc_close(d, 0); 232 fallthrough; 233 234 default: 235 sock_set_flag(sk, SOCK_ZAPPED); 236 break; 237 } 238 } 239 240 /* Close socket. 241 * Must be called on unlocked socket. 242 */ 243 static void rfcomm_sock_close(struct sock *sk) 244 { 245 __rfcomm_sock_close(sk); 246 } 247 248 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 249 { 250 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 251 252 BT_DBG("sk %p", sk); 253 254 if (parent) { 255 sk->sk_type = parent->sk_type; 256 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 257 &bt_sk(parent)->flags); 258 259 pi->sec_level = rfcomm_pi(parent)->sec_level; 260 pi->role_switch = rfcomm_pi(parent)->role_switch; 261 262 security_sk_clone(parent, sk); 263 } else { 264 pi->dlc->defer_setup = 0; 265 266 pi->sec_level = BT_SECURITY_LOW; 267 pi->role_switch = 0; 268 } 269 270 pi->dlc->sec_level = pi->sec_level; 271 pi->dlc->role_switch = pi->role_switch; 272 } 273 274 static struct proto rfcomm_proto = { 275 .name = "RFCOMM", 276 .owner = THIS_MODULE, 277 .obj_size = sizeof(struct rfcomm_pinfo) 278 }; 279 280 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, 281 int proto, gfp_t prio, int kern) 282 { 283 struct rfcomm_dlc *d; 284 struct sock *sk; 285 286 d = rfcomm_dlc_alloc(prio); 287 if (!d) 288 return NULL; 289 290 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); 291 if (!sk) { 292 rfcomm_dlc_free(d); 293 return NULL; 294 } 295 296 d->data_ready = rfcomm_sk_data_ready; 297 d->state_change = rfcomm_sk_state_change; 298 299 rfcomm_pi(sk)->dlc = d; 300 d->owner = sk; 301 302 sk->sk_destruct = rfcomm_sock_destruct; 303 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 304 305 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 306 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 307 308 bt_sock_link(&rfcomm_sk_list, sk); 309 310 BT_DBG("sk %p", sk); 311 return sk; 312 } 313 314 static int rfcomm_sock_create(struct net *net, struct socket *sock, 315 int protocol, int kern) 316 { 317 struct sock *sk; 318 319 BT_DBG("sock %p", sock); 320 321 sock->state = SS_UNCONNECTED; 322 323 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 324 return -ESOCKTNOSUPPORT; 325 326 sock->ops = &rfcomm_sock_ops; 327 328 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 329 if (!sk) 330 return -ENOMEM; 331 332 rfcomm_sock_init(sk, NULL); 333 return 0; 334 } 335 336 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len) 337 { 338 struct sockaddr_rc sa; 339 struct sock *sk = sock->sk; 340 int len, err = 0; 341 342 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 343 addr->sa_family != AF_BLUETOOTH) 344 return -EINVAL; 345 346 memset(&sa, 0, sizeof(sa)); 347 len = min_t(unsigned int, sizeof(sa), addr_len); 348 memcpy(&sa, addr, len); 349 350 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 351 352 lock_sock(sk); 353 354 if (sk->sk_state != BT_OPEN) { 355 err = -EBADFD; 356 goto done; 357 } 358 359 if (sk->sk_type != SOCK_STREAM) { 360 err = -EINVAL; 361 goto done; 362 } 363 364 write_lock(&rfcomm_sk_list.lock); 365 366 if (sa.rc_channel && 367 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 368 err = -EADDRINUSE; 369 } else { 370 /* Save source address */ 371 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 372 rfcomm_pi(sk)->channel = sa.rc_channel; 373 sk->sk_state = BT_BOUND; 374 } 375 376 write_unlock(&rfcomm_sk_list.lock); 377 378 done: 379 release_sock(sk); 380 return err; 381 } 382 383 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 384 int alen, int flags) 385 { 386 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 387 struct sock *sk = sock->sk; 388 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 389 int err = 0; 390 391 BT_DBG("sk %p", sk); 392 393 if (alen < sizeof(struct sockaddr_rc) || 394 addr->sa_family != AF_BLUETOOTH) 395 return -EINVAL; 396 397 sock_hold(sk); 398 lock_sock(sk); 399 400 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 401 err = -EBADFD; 402 goto done; 403 } 404 405 if (sk->sk_type != SOCK_STREAM) { 406 err = -EINVAL; 407 goto done; 408 } 409 410 sk->sk_state = BT_CONNECT; 411 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 412 rfcomm_pi(sk)->channel = sa->rc_channel; 413 414 d->sec_level = rfcomm_pi(sk)->sec_level; 415 d->role_switch = rfcomm_pi(sk)->role_switch; 416 417 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ 418 release_sock(sk); 419 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 420 sa->rc_channel); 421 lock_sock(sk); 422 if (!err && !sock_flag(sk, SOCK_ZAPPED)) 423 err = bt_sock_wait_state(sk, BT_CONNECTED, 424 sock_sndtimeo(sk, flags & O_NONBLOCK)); 425 426 done: 427 release_sock(sk); 428 sock_put(sk); 429 return err; 430 } 431 432 static int rfcomm_sock_listen(struct socket *sock, int backlog) 433 { 434 struct sock *sk = sock->sk; 435 int err = 0; 436 437 BT_DBG("sk %p backlog %d", sk, backlog); 438 439 lock_sock(sk); 440 441 if (sk->sk_state != BT_BOUND) { 442 err = -EBADFD; 443 goto done; 444 } 445 446 if (sk->sk_type != SOCK_STREAM) { 447 err = -EINVAL; 448 goto done; 449 } 450 451 if (!rfcomm_pi(sk)->channel) { 452 bdaddr_t *src = &rfcomm_pi(sk)->src; 453 u8 channel; 454 455 err = -EINVAL; 456 457 write_lock(&rfcomm_sk_list.lock); 458 459 for (channel = 1; channel < 31; channel++) 460 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 461 rfcomm_pi(sk)->channel = channel; 462 err = 0; 463 break; 464 } 465 466 write_unlock(&rfcomm_sk_list.lock); 467 468 if (err < 0) 469 goto done; 470 } 471 472 sk->sk_max_ack_backlog = backlog; 473 sk->sk_ack_backlog = 0; 474 sk->sk_state = BT_LISTEN; 475 476 done: 477 release_sock(sk); 478 return err; 479 } 480 481 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, 482 struct proto_accept_arg *arg) 483 { 484 DEFINE_WAIT_FUNC(wait, woken_wake_function); 485 struct sock *sk = sock->sk, *nsk; 486 long timeo; 487 int err = 0; 488 489 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 490 491 if (sk->sk_type != SOCK_STREAM) { 492 err = -EINVAL; 493 goto done; 494 } 495 496 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 497 498 BT_DBG("sk %p timeo %ld", sk, timeo); 499 500 /* Wait for an incoming connection. (wake-one). */ 501 add_wait_queue_exclusive(sk_sleep(sk), &wait); 502 while (1) { 503 if (sk->sk_state != BT_LISTEN) { 504 err = -EBADFD; 505 break; 506 } 507 508 nsk = bt_accept_dequeue(sk, newsock); 509 if (nsk) { 510 /* Drop the bridging ref from bt_accept_dequeue(); 511 * the grafted socket keeps nsk alive from here. 512 */ 513 sock_put(nsk); 514 break; 515 } 516 517 if (!timeo) { 518 err = -EAGAIN; 519 break; 520 } 521 522 if (signal_pending(current)) { 523 err = sock_intr_errno(timeo); 524 break; 525 } 526 527 release_sock(sk); 528 529 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 530 531 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 532 } 533 remove_wait_queue(sk_sleep(sk), &wait); 534 535 if (err) 536 goto done; 537 538 newsock->state = SS_CONNECTED; 539 540 BT_DBG("new socket %p", nsk); 541 542 done: 543 release_sock(sk); 544 return err; 545 } 546 547 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 548 { 549 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 550 struct sock *sk = sock->sk; 551 552 BT_DBG("sock %p, sk %p", sock, sk); 553 554 if (peer && sk->sk_state != BT_CONNECTED && 555 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 556 return -ENOTCONN; 557 558 memset(sa, 0, sizeof(*sa)); 559 sa->rc_family = AF_BLUETOOTH; 560 sa->rc_channel = rfcomm_pi(sk)->channel; 561 if (peer) 562 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 563 else 564 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 565 566 return sizeof(struct sockaddr_rc); 567 } 568 569 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 570 size_t len) 571 { 572 struct sock *sk = sock->sk; 573 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 574 struct sk_buff *skb; 575 int sent; 576 577 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 578 return -ENOTCONN; 579 580 if (msg->msg_flags & MSG_OOB) 581 return -EOPNOTSUPP; 582 583 if (sk->sk_shutdown & SEND_SHUTDOWN) 584 return -EPIPE; 585 586 BT_DBG("sock %p, sk %p", sock, sk); 587 588 lock_sock(sk); 589 590 sent = bt_sock_wait_ready(sk, msg->msg_flags); 591 592 release_sock(sk); 593 594 if (sent) 595 return sent; 596 597 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, 598 RFCOMM_SKB_TAIL_RESERVE); 599 if (IS_ERR(skb)) 600 return PTR_ERR(skb); 601 602 sent = rfcomm_dlc_send(d, skb); 603 if (sent < 0) 604 kfree_skb(skb); 605 606 return sent; 607 } 608 609 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 610 size_t size, int flags) 611 { 612 struct sock *sk = sock->sk; 613 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 614 int len; 615 616 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 617 rfcomm_dlc_accept(d); 618 return 0; 619 } 620 621 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 622 623 lock_sock(sk); 624 if (!(flags & MSG_PEEK) && len > 0) 625 atomic_sub(len, &sk->sk_rmem_alloc); 626 627 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 628 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 629 release_sock(sk); 630 631 return len; 632 } 633 634 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 635 sockptr_t optval, unsigned int optlen) 636 { 637 struct sock *sk = sock->sk; 638 int err = 0; 639 u32 opt; 640 641 BT_DBG("sk %p", sk); 642 643 lock_sock(sk); 644 645 switch (optname) { 646 case RFCOMM_LM: 647 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 648 if (err) 649 break; 650 651 if (opt & RFCOMM_LM_FIPS) { 652 err = -EINVAL; 653 break; 654 } 655 656 if (opt & RFCOMM_LM_AUTH) 657 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 658 if (opt & RFCOMM_LM_ENCRYPT) 659 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 660 if (opt & RFCOMM_LM_SECURE) 661 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 662 663 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 664 break; 665 666 default: 667 err = -ENOPROTOOPT; 668 break; 669 } 670 671 release_sock(sk); 672 return err; 673 } 674 675 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 676 sockptr_t optval, unsigned int optlen) 677 { 678 struct sock *sk = sock->sk; 679 struct bt_security sec; 680 int err = 0; 681 u32 opt; 682 683 BT_DBG("sk %p", sk); 684 685 if (level == SOL_RFCOMM) 686 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 687 688 if (level != SOL_BLUETOOTH) 689 return -ENOPROTOOPT; 690 691 lock_sock(sk); 692 693 switch (optname) { 694 case BT_SECURITY: 695 if (sk->sk_type != SOCK_STREAM) { 696 err = -EINVAL; 697 break; 698 } 699 700 sec.level = BT_SECURITY_LOW; 701 702 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 703 if (err) 704 break; 705 706 if (sec.level > BT_SECURITY_HIGH) { 707 err = -EINVAL; 708 break; 709 } 710 711 rfcomm_pi(sk)->sec_level = sec.level; 712 break; 713 714 case BT_DEFER_SETUP: 715 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 716 err = -EINVAL; 717 break; 718 } 719 720 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 721 if (err) 722 break; 723 724 if (opt) 725 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 726 else 727 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 728 729 break; 730 731 default: 732 err = -ENOPROTOOPT; 733 break; 734 } 735 736 release_sock(sk); 737 return err; 738 } 739 740 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, 741 sockopt_t *sopt) 742 { 743 struct sock *sk = sock->sk; 744 struct sock *l2cap_sk; 745 struct l2cap_conn *conn; 746 struct rfcomm_conninfo cinfo; 747 int err = 0; 748 size_t len; 749 u32 opt; 750 751 BT_DBG("sk %p", sk); 752 753 len = sopt->optlen; 754 755 lock_sock(sk); 756 757 switch (optname) { 758 case RFCOMM_LM: 759 switch (rfcomm_pi(sk)->sec_level) { 760 case BT_SECURITY_LOW: 761 opt = RFCOMM_LM_AUTH; 762 break; 763 case BT_SECURITY_MEDIUM: 764 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 765 break; 766 case BT_SECURITY_HIGH: 767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 768 RFCOMM_LM_SECURE; 769 break; 770 case BT_SECURITY_FIPS: 771 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 772 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 773 break; 774 default: 775 opt = 0; 776 break; 777 } 778 779 if (rfcomm_pi(sk)->role_switch) 780 opt |= RFCOMM_LM_MASTER; 781 782 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 783 sizeof(opt)) 784 err = -EFAULT; 785 786 break; 787 788 case RFCOMM_CONNINFO: 789 if (sk->sk_state != BT_CONNECTED && 790 !rfcomm_pi(sk)->dlc->defer_setup) { 791 err = -ENOTCONN; 792 break; 793 } 794 795 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 796 conn = l2cap_pi(l2cap_sk)->chan->conn; 797 798 memset(&cinfo, 0, sizeof(cinfo)); 799 cinfo.hci_handle = conn->hcon->handle; 800 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 801 802 len = min(len, sizeof(cinfo)); 803 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 804 err = -EFAULT; 805 806 break; 807 808 default: 809 err = -ENOPROTOOPT; 810 break; 811 } 812 813 release_sock(sk); 814 return err; 815 } 816 817 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, 818 sockopt_t *sopt) 819 { 820 struct sock *sk = sock->sk; 821 struct bt_security sec; 822 int err = 0; 823 size_t len; 824 u32 opt; 825 826 BT_DBG("sk %p", sk); 827 828 if (level == SOL_RFCOMM) 829 return rfcomm_sock_getsockopt_old(sock, optname, sopt); 830 831 if (level != SOL_BLUETOOTH) 832 return -ENOPROTOOPT; 833 834 len = sopt->optlen; 835 836 lock_sock(sk); 837 838 switch (optname) { 839 case BT_SECURITY: 840 if (sk->sk_type != SOCK_STREAM) { 841 err = -EINVAL; 842 break; 843 } 844 845 sec.level = rfcomm_pi(sk)->sec_level; 846 sec.key_size = 0; 847 848 len = min(len, sizeof(sec)); 849 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 850 err = -EFAULT; 851 852 break; 853 854 case BT_DEFER_SETUP: 855 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 856 err = -EINVAL; 857 break; 858 } 859 860 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 861 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 862 sizeof(opt)) 863 err = -EFAULT; 864 865 break; 866 867 default: 868 err = -ENOPROTOOPT; 869 break; 870 } 871 872 release_sock(sk); 873 return err; 874 } 875 876 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 877 { 878 struct sock *sk __maybe_unused = sock->sk; 879 int err; 880 881 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 882 883 err = bt_sock_ioctl(sock, cmd, arg); 884 885 if (err == -ENOIOCTLCMD) { 886 #ifdef CONFIG_BT_RFCOMM_TTY 887 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 888 #else 889 err = -EOPNOTSUPP; 890 #endif 891 } 892 893 return err; 894 } 895 896 #ifdef CONFIG_COMPAT 897 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 898 { 899 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 900 } 901 #endif 902 903 static int rfcomm_sock_shutdown(struct socket *sock, int how) 904 { 905 struct sock *sk = sock->sk; 906 bool cleanup_listen = false; 907 int err = 0; 908 909 BT_DBG("sock %p, sk %p", sock, sk); 910 911 if (!sk) 912 return 0; 913 914 lock_sock(sk); 915 if (!sk->sk_shutdown) { 916 sk->sk_shutdown = SHUTDOWN_MASK; 917 if (sk->sk_state == BT_LISTEN) { 918 /* Block new children before cleaning up without sk lock. */ 919 sk->sk_state = BT_CLOSED; 920 cleanup_listen = true; 921 } 922 923 release_sock(sk); 924 if (cleanup_listen) 925 rfcomm_sock_cleanup_listen(sk); 926 else 927 __rfcomm_sock_close(sk); 928 lock_sock(sk); 929 930 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 931 !(current->flags & PF_EXITING)) 932 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 933 } 934 release_sock(sk); 935 return err; 936 } 937 938 static int rfcomm_sock_release(struct socket *sock) 939 { 940 struct sock *sk = sock->sk; 941 int err; 942 943 BT_DBG("sock %p, sk %p", sock, sk); 944 945 if (!sk) 946 return 0; 947 948 err = rfcomm_sock_shutdown(sock, 2); 949 950 sock_orphan(sk); 951 rfcomm_sock_kill(sk); 952 return err; 953 } 954 955 /* ---- RFCOMM core layer callbacks ---- 956 * 957 * called under rfcomm_lock() 958 */ 959 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 960 { 961 struct sock *sk, *parent; 962 bdaddr_t src, dst; 963 bool defer_setup = false; 964 int result = 0; 965 966 BT_DBG("session %p channel %d", s, channel); 967 968 rfcomm_session_getaddr(s, &src, &dst); 969 970 /* Check if we have socket listening on channel */ 971 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 972 if (!parent) 973 return 0; 974 975 lock_sock(parent); 976 977 if (parent->sk_state != BT_LISTEN) 978 goto done; 979 980 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags); 981 982 /* Check for backlog size */ 983 if (sk_acceptq_is_full(parent)) { 984 BT_DBG("backlog full %d", parent->sk_ack_backlog); 985 goto done; 986 } 987 988 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 989 if (!sk) 990 goto done; 991 992 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 993 994 rfcomm_sock_init(sk, parent); 995 bacpy(&rfcomm_pi(sk)->src, &src); 996 bacpy(&rfcomm_pi(sk)->dst, &dst); 997 rfcomm_pi(sk)->channel = channel; 998 999 sk->sk_state = BT_CONFIG; 1000 bt_accept_enqueue(parent, sk, true); 1001 1002 /* Accept connection and return socket DLC */ 1003 *d = rfcomm_pi(sk)->dlc; 1004 result = 1; 1005 1006 done: 1007 release_sock(parent); 1008 1009 if (defer_setup) 1010 parent->sk_state_change(parent); 1011 1012 sock_put(parent); 1013 1014 return result; 1015 } 1016 1017 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1018 { 1019 struct sock *sk; 1020 1021 read_lock(&rfcomm_sk_list.lock); 1022 1023 sk_for_each(sk, &rfcomm_sk_list.head) { 1024 seq_printf(f, "%pMR %pMR %d %d\n", 1025 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1026 sk->sk_state, rfcomm_pi(sk)->channel); 1027 } 1028 1029 read_unlock(&rfcomm_sk_list.lock); 1030 1031 return 0; 1032 } 1033 1034 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs); 1035 1036 static struct dentry *rfcomm_sock_debugfs; 1037 1038 static const struct proto_ops rfcomm_sock_ops = { 1039 .family = PF_BLUETOOTH, 1040 .owner = THIS_MODULE, 1041 .release = rfcomm_sock_release, 1042 .bind = rfcomm_sock_bind, 1043 .connect = rfcomm_sock_connect, 1044 .listen = rfcomm_sock_listen, 1045 .accept = rfcomm_sock_accept, 1046 .getname = rfcomm_sock_getname, 1047 .sendmsg = rfcomm_sock_sendmsg, 1048 .recvmsg = rfcomm_sock_recvmsg, 1049 .shutdown = rfcomm_sock_shutdown, 1050 .setsockopt = rfcomm_sock_setsockopt, 1051 .getsockopt_iter = rfcomm_sock_getsockopt, 1052 .ioctl = rfcomm_sock_ioctl, 1053 .gettstamp = sock_gettstamp, 1054 .poll = bt_sock_poll, 1055 .socketpair = sock_no_socketpair, 1056 .mmap = sock_no_mmap, 1057 #ifdef CONFIG_COMPAT 1058 .compat_ioctl = rfcomm_sock_compat_ioctl, 1059 #endif 1060 }; 1061 1062 static const struct net_proto_family rfcomm_sock_family_ops = { 1063 .family = PF_BLUETOOTH, 1064 .owner = THIS_MODULE, 1065 .create = rfcomm_sock_create 1066 }; 1067 1068 int __init rfcomm_init_sockets(void) 1069 { 1070 int err; 1071 1072 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1073 1074 err = proto_register(&rfcomm_proto, 0); 1075 if (err < 0) 1076 return err; 1077 1078 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1079 if (err < 0) { 1080 BT_ERR("RFCOMM socket layer registration failed"); 1081 goto error; 1082 } 1083 1084 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1085 if (err < 0) { 1086 BT_ERR("Failed to create RFCOMM proc file"); 1087 bt_sock_unregister(BTPROTO_RFCOMM); 1088 goto error; 1089 } 1090 1091 BT_INFO("RFCOMM socket layer initialized"); 1092 1093 if (IS_ERR_OR_NULL(bt_debugfs)) 1094 return 0; 1095 1096 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1097 bt_debugfs, NULL, 1098 &rfcomm_sock_debugfs_fops); 1099 1100 return 0; 1101 1102 error: 1103 proto_unregister(&rfcomm_proto); 1104 return err; 1105 } 1106 1107 void __exit rfcomm_cleanup_sockets(void) 1108 { 1109 bt_procfs_cleanup(&init_net, "rfcomm"); 1110 1111 debugfs_remove(rfcomm_sock_debugfs); 1112 1113 bt_sock_unregister(BTPROTO_RFCOMM); 1114 1115 proto_unregister(&rfcomm_proto); 1116 } 1117