1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI sockets. */ 23 #include <linux/compat.h> 24 #include <linux/export.h> 25 #include <linux/utsname.h> 26 #include <linux/sched.h> 27 #include <linux/uio.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_mon.h> 33 #include <net/bluetooth/mgmt.h> 34 35 #include "mgmt_util.h" 36 37 static LIST_HEAD(mgmt_chan_list); 38 static DEFINE_MUTEX(mgmt_chan_list_lock); 39 40 static DEFINE_IDA(sock_cookie_ida); 41 42 static atomic_t monitor_promisc = ATOMIC_INIT(0); 43 44 /* ----- HCI socket interface ----- */ 45 46 /* Socket info */ 47 #define hci_pi(sk) ((struct hci_pinfo *) sk) 48 49 struct hci_pinfo { 50 struct bt_sock bt; 51 struct hci_dev *hdev; 52 struct hci_filter filter; 53 __u8 cmsg_mask; 54 unsigned short channel; 55 unsigned long flags; 56 __u32 cookie; 57 char comm[TASK_COMM_LEN]; 58 __u16 mtu; 59 }; 60 61 static struct hci_dev *hci_hdev_from_sock(struct sock *sk) 62 { 63 struct hci_dev *hdev = hci_pi(sk)->hdev; 64 65 if (!hdev) 66 return ERR_PTR(-EBADFD); 67 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 68 return ERR_PTR(-EPIPE); 69 return hdev; 70 } 71 72 void hci_sock_set_flag(struct sock *sk, int nr) 73 { 74 set_bit(nr, &hci_pi(sk)->flags); 75 } 76 77 void hci_sock_clear_flag(struct sock *sk, int nr) 78 { 79 clear_bit(nr, &hci_pi(sk)->flags); 80 } 81 82 int hci_sock_test_flag(struct sock *sk, int nr) 83 { 84 return test_bit(nr, &hci_pi(sk)->flags); 85 } 86 87 unsigned short hci_sock_get_channel(struct sock *sk) 88 { 89 return hci_pi(sk)->channel; 90 } 91 92 u32 hci_sock_get_cookie(struct sock *sk) 93 { 94 return hci_pi(sk)->cookie; 95 } 96 97 static bool hci_sock_gen_cookie(struct sock *sk) 98 { 99 int id = hci_pi(sk)->cookie; 100 101 if (!id) { 102 id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL); 103 if (id < 0) 104 id = 0xffffffff; 105 106 hci_pi(sk)->cookie = id; 107 get_task_comm(hci_pi(sk)->comm, current); 108 return true; 109 } 110 111 return false; 112 } 113 114 static void hci_sock_free_cookie(struct sock *sk) 115 { 116 int id = hci_pi(sk)->cookie; 117 118 if (id) { 119 hci_pi(sk)->cookie = 0; 120 ida_free(&sock_cookie_ida, id); 121 } 122 } 123 124 static inline int hci_test_bit(int nr, const void *addr) 125 { 126 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 127 } 128 129 /* Security filter */ 130 #define HCI_SFLT_MAX_OGF 5 131 132 struct hci_sec_filter { 133 __u32 type_mask; 134 __u32 event_mask[2]; 135 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4]; 136 }; 137 138 static const struct hci_sec_filter hci_sec_filter = { 139 /* Packet types */ 140 0x10, 141 /* Events */ 142 { 0x1000d9fe, 0x0000b00c }, 143 /* Commands */ 144 { 145 { 0x0 }, 146 /* OGF_LINK_CTL */ 147 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 148 /* OGF_LINK_POLICY */ 149 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 150 /* OGF_HOST_CTL */ 151 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 152 /* OGF_INFO_PARAM */ 153 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 154 /* OGF_STATUS_PARAM */ 155 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 156 } 157 }; 158 159 static struct bt_sock_list hci_sk_list = { 160 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 161 }; 162 163 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) 164 { 165 struct hci_filter *flt; 166 int flt_type, flt_event; 167 u8 event; 168 169 /* Apply filter */ 170 flt = &hci_pi(sk)->filter; 171 172 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS; 173 174 if (!test_bit(flt_type, &flt->type_mask)) 175 return true; 176 177 /* Extra filter for event packets only */ 178 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) 179 return false; 180 181 if (skb->len < 1) 182 return true; 183 184 event = *(__u8 *)skb->data; 185 flt_event = event & HCI_FLT_EVENT_BITS; 186 187 if (!hci_test_bit(flt_event, &flt->event_mask)) 188 return true; 189 190 /* Check filter only when opcode is set */ 191 if (!flt->opcode) 192 return false; 193 194 if (event == HCI_EV_CMD_COMPLETE && skb->len < 5) 195 return true; 196 197 if (event == HCI_EV_CMD_COMPLETE && 198 flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) 199 return true; 200 201 if (event == HCI_EV_CMD_STATUS && skb->len < 6) 202 return true; 203 204 if (event == HCI_EV_CMD_STATUS && 205 flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) 206 return true; 207 208 return false; 209 } 210 211 /* Send frame to RAW socket */ 212 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 213 { 214 struct sock *sk; 215 struct sk_buff *skb_copy = NULL; 216 217 BT_DBG("hdev %p len %d", hdev, skb->len); 218 219 read_lock(&hci_sk_list.lock); 220 221 sk_for_each(sk, &hci_sk_list.head) { 222 struct sk_buff *nskb; 223 224 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 225 continue; 226 227 /* Don't send frame to the socket it came from */ 228 if (skb->sk == sk) 229 continue; 230 231 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { 232 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 233 hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 234 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 235 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 236 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) 237 continue; 238 if (is_filtered_packet(sk, skb)) 239 continue; 240 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 241 if (!bt_cb(skb)->incoming) 242 continue; 243 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 244 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 245 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 246 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 247 hci_skb_pkt_type(skb) != HCI_DRV_PKT) 248 continue; 249 } else { 250 /* Don't send frame to other channel types */ 251 continue; 252 } 253 254 if (!skb_copy) { 255 /* Create a private copy with headroom */ 256 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true); 257 if (!skb_copy) 258 continue; 259 260 /* Put type byte before the data */ 261 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1); 262 } 263 264 nskb = skb_clone(skb_copy, GFP_ATOMIC); 265 if (!nskb) 266 continue; 267 268 if (sock_queue_rcv_skb(sk, nskb)) 269 kfree_skb(nskb); 270 } 271 272 read_unlock(&hci_sk_list.lock); 273 274 kfree_skb(skb_copy); 275 } 276 277 static void hci_sock_copy_creds(struct sock *sk, struct sk_buff *skb) 278 { 279 struct scm_creds *creds; 280 281 if (!sk || WARN_ON(!skb)) 282 return; 283 284 creds = &bt_cb(skb)->creds; 285 286 /* Check if peer credentials is set */ 287 if (!sk->sk_peer_pid) { 288 /* Check if parent peer credentials is set */ 289 if (bt_sk(sk)->parent && bt_sk(sk)->parent->sk_peer_pid) 290 sk = bt_sk(sk)->parent; 291 else 292 return; 293 } 294 295 /* Check if scm_creds already set */ 296 if (creds->pid == pid_vnr(sk->sk_peer_pid)) 297 return; 298 299 memset(creds, 0, sizeof(*creds)); 300 301 creds->pid = pid_vnr(sk->sk_peer_pid); 302 if (sk->sk_peer_cred) { 303 creds->uid = sk->sk_peer_cred->uid; 304 creds->gid = sk->sk_peer_cred->gid; 305 } 306 } 307 308 static struct sk_buff *hci_skb_clone(struct sk_buff *skb) 309 { 310 struct sk_buff *nskb; 311 312 if (!skb) 313 return NULL; 314 315 nskb = skb_clone(skb, GFP_ATOMIC); 316 if (!nskb) 317 return NULL; 318 319 hci_sock_copy_creds(skb->sk, nskb); 320 321 return nskb; 322 } 323 324 /* Send frame to sockets with specific channel */ 325 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 326 int flag, struct sock *skip_sk) 327 { 328 struct sock *sk; 329 330 BT_DBG("channel %u len %d", channel, skb->len); 331 332 sk_for_each(sk, &hci_sk_list.head) { 333 struct sk_buff *nskb; 334 335 /* Ignore socket without the flag set */ 336 if (!hci_sock_test_flag(sk, flag)) 337 continue; 338 339 /* Skip the original socket */ 340 if (sk == skip_sk) 341 continue; 342 343 if (sk->sk_state != BT_BOUND) 344 continue; 345 346 if (hci_pi(sk)->channel != channel) 347 continue; 348 349 nskb = hci_skb_clone(skb); 350 if (!nskb) 351 continue; 352 353 if (sock_queue_rcv_skb(sk, nskb)) 354 kfree_skb(nskb); 355 } 356 357 } 358 359 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 360 int flag, struct sock *skip_sk) 361 { 362 read_lock(&hci_sk_list.lock); 363 __hci_send_to_channel(channel, skb, flag, skip_sk); 364 read_unlock(&hci_sk_list.lock); 365 } 366 367 /* Send frame to monitor socket */ 368 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb) 369 { 370 struct sk_buff *skb_copy = NULL; 371 struct hci_mon_hdr *hdr; 372 __le16 opcode; 373 374 if (!atomic_read(&monitor_promisc)) 375 return; 376 377 BT_DBG("hdev %p len %d", hdev, skb->len); 378 379 switch (hci_skb_pkt_type(skb)) { 380 case HCI_COMMAND_PKT: 381 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT); 382 break; 383 case HCI_EVENT_PKT: 384 opcode = cpu_to_le16(HCI_MON_EVENT_PKT); 385 break; 386 case HCI_ACLDATA_PKT: 387 if (bt_cb(skb)->incoming) 388 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT); 389 else 390 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT); 391 break; 392 case HCI_SCODATA_PKT: 393 if (bt_cb(skb)->incoming) 394 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT); 395 else 396 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT); 397 break; 398 case HCI_ISODATA_PKT: 399 if (bt_cb(skb)->incoming) 400 opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT); 401 else 402 opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT); 403 break; 404 case HCI_DRV_PKT: 405 if (bt_cb(skb)->incoming) 406 opcode = cpu_to_le16(HCI_MON_DRV_RX_PKT); 407 else 408 opcode = cpu_to_le16(HCI_MON_DRV_TX_PKT); 409 break; 410 case HCI_DIAG_PKT: 411 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG); 412 break; 413 default: 414 return; 415 } 416 417 /* Create a private copy with headroom */ 418 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true); 419 if (!skb_copy) 420 return; 421 422 hci_sock_copy_creds(skb->sk, skb_copy); 423 424 /* Put header before the data */ 425 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE); 426 hdr->opcode = opcode; 427 hdr->index = cpu_to_le16(hdev->id); 428 hdr->len = cpu_to_le16(skb->len); 429 430 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy, 431 HCI_SOCK_TRUSTED, NULL); 432 kfree_skb(skb_copy); 433 } 434 435 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 436 void *data, u16 data_len, ktime_t tstamp, 437 int flag, struct sock *skip_sk) 438 { 439 struct sock *sk; 440 __le16 index; 441 442 if (hdev) 443 index = cpu_to_le16(hdev->id); 444 else 445 index = cpu_to_le16(MGMT_INDEX_NONE); 446 447 read_lock(&hci_sk_list.lock); 448 449 sk_for_each(sk, &hci_sk_list.head) { 450 struct hci_mon_hdr *hdr; 451 struct sk_buff *skb; 452 453 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL) 454 continue; 455 456 /* Ignore socket without the flag set */ 457 if (!hci_sock_test_flag(sk, flag)) 458 continue; 459 460 /* Skip the original socket */ 461 if (sk == skip_sk) 462 continue; 463 464 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC); 465 if (!skb) 466 continue; 467 468 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 469 put_unaligned_le16(event, skb_put(skb, 2)); 470 471 if (data) 472 skb_put_data(skb, data, data_len); 473 474 skb->tstamp = tstamp; 475 476 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 477 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT); 478 hdr->index = index; 479 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 480 481 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 482 HCI_SOCK_TRUSTED, NULL); 483 kfree_skb(skb); 484 } 485 486 read_unlock(&hci_sk_list.lock); 487 } 488 489 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) 490 { 491 struct hci_mon_hdr *hdr; 492 struct hci_mon_new_index *ni; 493 struct hci_mon_index_info *ii; 494 struct sk_buff *skb; 495 __le16 opcode; 496 497 switch (event) { 498 case HCI_DEV_REG: 499 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC); 500 if (!skb) 501 return NULL; 502 503 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); 504 ni->type = 0x00; /* Old hdev->dev_type */ 505 ni->bus = hdev->bus; 506 bacpy(&ni->bdaddr, &hdev->bdaddr); 507 memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, 508 strnlen(hdev->name, sizeof(ni->name)), '\0'); 509 510 opcode = cpu_to_le16(HCI_MON_NEW_INDEX); 511 break; 512 513 case HCI_DEV_UNREG: 514 skb = bt_skb_alloc(0, GFP_ATOMIC); 515 if (!skb) 516 return NULL; 517 518 opcode = cpu_to_le16(HCI_MON_DEL_INDEX); 519 break; 520 521 case HCI_DEV_SETUP: 522 if (hdev->manufacturer == 0xffff) 523 return NULL; 524 fallthrough; 525 526 case HCI_DEV_UP: 527 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC); 528 if (!skb) 529 return NULL; 530 531 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE); 532 bacpy(&ii->bdaddr, &hdev->bdaddr); 533 ii->manufacturer = cpu_to_le16(hdev->manufacturer); 534 535 opcode = cpu_to_le16(HCI_MON_INDEX_INFO); 536 break; 537 538 case HCI_DEV_OPEN: 539 skb = bt_skb_alloc(0, GFP_ATOMIC); 540 if (!skb) 541 return NULL; 542 543 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX); 544 break; 545 546 case HCI_DEV_CLOSE: 547 skb = bt_skb_alloc(0, GFP_ATOMIC); 548 if (!skb) 549 return NULL; 550 551 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX); 552 break; 553 554 default: 555 return NULL; 556 } 557 558 __net_timestamp(skb); 559 560 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 561 hdr->opcode = opcode; 562 hdr->index = cpu_to_le16(hdev->id); 563 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 564 565 return skb; 566 } 567 568 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk) 569 { 570 struct hci_mon_hdr *hdr; 571 struct sk_buff *skb; 572 u16 format; 573 u8 ver[3]; 574 u32 flags; 575 576 /* No message needed when cookie is not present */ 577 if (!hci_pi(sk)->cookie) 578 return NULL; 579 580 switch (hci_pi(sk)->channel) { 581 case HCI_CHANNEL_RAW: 582 format = 0x0000; 583 ver[0] = BT_SUBSYS_VERSION; 584 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 585 break; 586 case HCI_CHANNEL_USER: 587 format = 0x0001; 588 ver[0] = BT_SUBSYS_VERSION; 589 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 590 break; 591 case HCI_CHANNEL_CONTROL: 592 format = 0x0002; 593 mgmt_fill_version_info(ver); 594 break; 595 default: 596 /* No message for unsupported format */ 597 return NULL; 598 } 599 600 skb = bt_skb_alloc(14 + TASK_COMM_LEN, GFP_ATOMIC); 601 if (!skb) 602 return NULL; 603 604 hci_sock_copy_creds(sk, skb); 605 606 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0; 607 608 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 609 put_unaligned_le16(format, skb_put(skb, 2)); 610 skb_put_data(skb, ver, sizeof(ver)); 611 put_unaligned_le32(flags, skb_put(skb, 4)); 612 skb_put_u8(skb, TASK_COMM_LEN); 613 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN); 614 615 __net_timestamp(skb); 616 617 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 618 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN); 619 if (hci_pi(sk)->hdev) 620 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 621 else 622 hdr->index = cpu_to_le16(HCI_DEV_NONE); 623 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 624 625 return skb; 626 } 627 628 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk) 629 { 630 struct hci_mon_hdr *hdr; 631 struct sk_buff *skb; 632 633 /* No message needed when cookie is not present */ 634 if (!hci_pi(sk)->cookie) 635 return NULL; 636 637 switch (hci_pi(sk)->channel) { 638 case HCI_CHANNEL_RAW: 639 case HCI_CHANNEL_USER: 640 case HCI_CHANNEL_CONTROL: 641 break; 642 default: 643 /* No message for unsupported format */ 644 return NULL; 645 } 646 647 skb = bt_skb_alloc(4, GFP_ATOMIC); 648 if (!skb) 649 return NULL; 650 651 hci_sock_copy_creds(sk, skb); 652 653 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 654 655 __net_timestamp(skb); 656 657 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 658 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE); 659 if (hci_pi(sk)->hdev) 660 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 661 else 662 hdr->index = cpu_to_le16(HCI_DEV_NONE); 663 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 664 665 return skb; 666 } 667 668 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index, 669 u16 opcode, u16 len, 670 const void *buf) 671 { 672 struct hci_mon_hdr *hdr; 673 struct sk_buff *skb; 674 675 skb = bt_skb_alloc(6 + len, GFP_ATOMIC); 676 if (!skb) 677 return NULL; 678 679 hci_sock_copy_creds(sk, skb); 680 681 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 682 put_unaligned_le16(opcode, skb_put(skb, 2)); 683 684 if (buf) 685 skb_put_data(skb, buf, len); 686 687 __net_timestamp(skb); 688 689 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 690 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND); 691 hdr->index = cpu_to_le16(index); 692 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 693 694 return skb; 695 } 696 697 static void __printf(2, 3) 698 send_monitor_note(struct sock *sk, const char *fmt, ...) 699 { 700 size_t len; 701 struct hci_mon_hdr *hdr; 702 struct sk_buff *skb; 703 va_list args; 704 705 va_start(args, fmt); 706 len = vsnprintf(NULL, 0, fmt, args); 707 va_end(args); 708 709 skb = bt_skb_alloc(len + 1, GFP_ATOMIC); 710 if (!skb) 711 return; 712 713 hci_sock_copy_creds(sk, skb); 714 715 va_start(args, fmt); 716 vsprintf(skb_put(skb, len), fmt, args); 717 *(u8 *)skb_put(skb, 1) = 0; 718 va_end(args); 719 720 __net_timestamp(skb); 721 722 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE); 723 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE); 724 hdr->index = cpu_to_le16(HCI_DEV_NONE); 725 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 726 727 if (sock_queue_rcv_skb(sk, skb)) 728 kfree_skb(skb); 729 } 730 731 static void send_monitor_replay(struct sock *sk) 732 { 733 struct hci_dev *hdev; 734 735 read_lock(&hci_dev_list_lock); 736 737 list_for_each_entry(hdev, &hci_dev_list, list) { 738 struct sk_buff *skb; 739 740 skb = create_monitor_event(hdev, HCI_DEV_REG); 741 if (!skb) 742 continue; 743 744 if (sock_queue_rcv_skb(sk, skb)) 745 kfree_skb(skb); 746 747 if (!test_bit(HCI_RUNNING, &hdev->flags)) 748 continue; 749 750 skb = create_monitor_event(hdev, HCI_DEV_OPEN); 751 if (!skb) 752 continue; 753 754 if (sock_queue_rcv_skb(sk, skb)) 755 kfree_skb(skb); 756 757 if (test_bit(HCI_UP, &hdev->flags)) 758 skb = create_monitor_event(hdev, HCI_DEV_UP); 759 else if (hci_dev_test_flag(hdev, HCI_SETUP)) 760 skb = create_monitor_event(hdev, HCI_DEV_SETUP); 761 else 762 skb = NULL; 763 764 if (skb) { 765 if (sock_queue_rcv_skb(sk, skb)) 766 kfree_skb(skb); 767 } 768 } 769 770 read_unlock(&hci_dev_list_lock); 771 } 772 773 static void send_monitor_control_replay(struct sock *mon_sk) 774 { 775 struct sock *sk; 776 777 read_lock(&hci_sk_list.lock); 778 779 sk_for_each(sk, &hci_sk_list.head) { 780 struct sk_buff *skb; 781 782 skb = create_monitor_ctrl_open(sk); 783 if (!skb) 784 continue; 785 786 if (sock_queue_rcv_skb(mon_sk, skb)) 787 kfree_skb(skb); 788 } 789 790 read_unlock(&hci_sk_list.lock); 791 } 792 793 /* Generate internal stack event */ 794 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data) 795 { 796 struct hci_event_hdr *hdr; 797 struct hci_ev_stack_internal *ev; 798 struct sk_buff *skb; 799 800 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC); 801 if (!skb) 802 return; 803 804 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE); 805 hdr->evt = HCI_EV_STACK_INTERNAL; 806 hdr->plen = sizeof(*ev) + dlen; 807 808 ev = skb_put(skb, sizeof(*ev) + dlen); 809 ev->type = type; 810 memcpy(ev->data, data, dlen); 811 812 bt_cb(skb)->incoming = 1; 813 __net_timestamp(skb); 814 815 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 816 hci_send_to_sock(hdev, skb); 817 kfree_skb(skb); 818 } 819 820 void hci_sock_dev_event(struct hci_dev *hdev, int event) 821 { 822 BT_DBG("hdev %s event %d", hdev->name, event); 823 824 if (atomic_read(&monitor_promisc)) { 825 struct sk_buff *skb; 826 827 /* Send event to monitor */ 828 skb = create_monitor_event(hdev, event); 829 if (skb) { 830 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 831 HCI_SOCK_TRUSTED, NULL); 832 kfree_skb(skb); 833 } 834 } 835 836 if (event <= HCI_DEV_DOWN) { 837 struct hci_ev_si_device ev; 838 839 /* Send event to sockets */ 840 ev.event = event; 841 ev.dev_id = hdev->id; 842 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 843 } 844 845 if (event == HCI_DEV_UNREG) { 846 struct sock *sk; 847 848 /* Wake up sockets using this dead device */ 849 read_lock(&hci_sk_list.lock); 850 sk_for_each(sk, &hci_sk_list.head) { 851 if (hci_pi(sk)->hdev == hdev) { 852 sk->sk_err = EPIPE; 853 sk->sk_state_change(sk); 854 } 855 } 856 read_unlock(&hci_sk_list.lock); 857 } 858 } 859 860 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel) 861 { 862 struct hci_mgmt_chan *c; 863 864 list_for_each_entry(c, &mgmt_chan_list, list) { 865 if (c->channel == channel) 866 return c; 867 } 868 869 return NULL; 870 } 871 872 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel) 873 { 874 struct hci_mgmt_chan *c; 875 876 mutex_lock(&mgmt_chan_list_lock); 877 c = __hci_mgmt_chan_find(channel); 878 mutex_unlock(&mgmt_chan_list_lock); 879 880 return c; 881 } 882 883 int hci_mgmt_chan_register(struct hci_mgmt_chan *c) 884 { 885 if (c->channel < HCI_CHANNEL_CONTROL) 886 return -EINVAL; 887 888 mutex_lock(&mgmt_chan_list_lock); 889 if (__hci_mgmt_chan_find(c->channel)) { 890 mutex_unlock(&mgmt_chan_list_lock); 891 return -EALREADY; 892 } 893 894 list_add_tail(&c->list, &mgmt_chan_list); 895 896 mutex_unlock(&mgmt_chan_list_lock); 897 898 return 0; 899 } 900 EXPORT_SYMBOL(hci_mgmt_chan_register); 901 902 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c) 903 { 904 mutex_lock(&mgmt_chan_list_lock); 905 list_del(&c->list); 906 mutex_unlock(&mgmt_chan_list_lock); 907 } 908 EXPORT_SYMBOL(hci_mgmt_chan_unregister); 909 910 static int hci_sock_release(struct socket *sock) 911 { 912 struct sock *sk = sock->sk; 913 struct hci_dev *hdev; 914 struct sk_buff *skb; 915 916 BT_DBG("sock %p sk %p", sock, sk); 917 918 if (!sk) 919 return 0; 920 921 lock_sock(sk); 922 923 switch (hci_pi(sk)->channel) { 924 case HCI_CHANNEL_MONITOR: 925 atomic_dec(&monitor_promisc); 926 break; 927 case HCI_CHANNEL_RAW: 928 case HCI_CHANNEL_USER: 929 case HCI_CHANNEL_CONTROL: 930 /* Send event to monitor */ 931 skb = create_monitor_ctrl_close(sk); 932 if (skb) { 933 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 934 HCI_SOCK_TRUSTED, NULL); 935 kfree_skb(skb); 936 } 937 938 hci_sock_free_cookie(sk); 939 break; 940 } 941 942 bt_sock_unlink(&hci_sk_list, sk); 943 944 hdev = hci_pi(sk)->hdev; 945 if (hdev) { 946 if (hci_pi(sk)->channel == HCI_CHANNEL_USER && 947 !hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 948 /* When releasing a user channel exclusive access, 949 * call hci_dev_do_close directly instead of calling 950 * hci_dev_close to ensure the exclusive access will 951 * be released and the controller brought back down. 952 * 953 * The checking of HCI_AUTO_OFF is not needed in this 954 * case since it will have been cleared already when 955 * opening the user channel. 956 * 957 * Make sure to also check that we haven't already 958 * unregistered since all the cleanup will have already 959 * been complete and hdev will get released when we put 960 * below. 961 */ 962 hci_dev_do_close(hdev); 963 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 964 mgmt_index_added(hdev); 965 } 966 967 atomic_dec(&hdev->promisc); 968 hci_dev_put(hdev); 969 } 970 971 sock_orphan(sk); 972 release_sock(sk); 973 sock_put(sk); 974 return 0; 975 } 976 977 static int hci_sock_reject_list_add(struct hci_dev *hdev, void __user *arg) 978 { 979 bdaddr_t bdaddr; 980 int err; 981 982 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 983 return -EFAULT; 984 985 hci_dev_lock(hdev); 986 987 err = hci_bdaddr_list_add(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 988 989 hci_dev_unlock(hdev); 990 991 return err; 992 } 993 994 static int hci_sock_reject_list_del(struct hci_dev *hdev, void __user *arg) 995 { 996 bdaddr_t bdaddr; 997 int err; 998 999 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 1000 return -EFAULT; 1001 1002 hci_dev_lock(hdev); 1003 1004 err = hci_bdaddr_list_del(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 1005 1006 hci_dev_unlock(hdev); 1007 1008 return err; 1009 } 1010 1011 /* Ioctls that require bound socket */ 1012 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, 1013 unsigned long arg) 1014 { 1015 struct hci_dev *hdev = hci_hdev_from_sock(sk); 1016 1017 if (IS_ERR(hdev)) 1018 return PTR_ERR(hdev); 1019 1020 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 1021 return -EBUSY; 1022 1023 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1024 return -EOPNOTSUPP; 1025 1026 switch (cmd) { 1027 case HCISETRAW: 1028 if (!capable(CAP_NET_ADMIN)) 1029 return -EPERM; 1030 return -EOPNOTSUPP; 1031 1032 case HCIGETCONNINFO: 1033 return hci_get_conn_info(hdev, (void __user *)arg); 1034 1035 case HCIGETAUTHINFO: 1036 return hci_get_auth_info(hdev, (void __user *)arg); 1037 1038 case HCIBLOCKADDR: 1039 if (!capable(CAP_NET_ADMIN)) 1040 return -EPERM; 1041 return hci_sock_reject_list_add(hdev, (void __user *)arg); 1042 1043 case HCIUNBLOCKADDR: 1044 if (!capable(CAP_NET_ADMIN)) 1045 return -EPERM; 1046 return hci_sock_reject_list_del(hdev, (void __user *)arg); 1047 } 1048 1049 return -ENOIOCTLCMD; 1050 } 1051 1052 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, 1053 unsigned long arg) 1054 { 1055 void __user *argp = (void __user *)arg; 1056 struct sock *sk = sock->sk; 1057 int err; 1058 1059 BT_DBG("cmd %x arg %lx", cmd, arg); 1060 1061 /* Make sure the cmd is valid before doing anything */ 1062 switch (cmd) { 1063 case HCIGETDEVLIST: 1064 case HCIGETDEVINFO: 1065 case HCIGETCONNLIST: 1066 case HCIDEVUP: 1067 case HCIDEVDOWN: 1068 case HCIDEVRESET: 1069 case HCIDEVRESTAT: 1070 case HCISETSCAN: 1071 case HCISETAUTH: 1072 case HCISETENCRYPT: 1073 case HCISETPTYPE: 1074 case HCISETLINKPOL: 1075 case HCISETLINKMODE: 1076 case HCISETACLMTU: 1077 case HCISETSCOMTU: 1078 case HCIINQUIRY: 1079 case HCISETRAW: 1080 case HCIGETCONNINFO: 1081 case HCIGETAUTHINFO: 1082 case HCIBLOCKADDR: 1083 case HCIUNBLOCKADDR: 1084 break; 1085 default: 1086 return -ENOIOCTLCMD; 1087 } 1088 1089 lock_sock(sk); 1090 1091 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1092 err = -EBADFD; 1093 goto done; 1094 } 1095 1096 /* When calling an ioctl on an unbound raw socket, then ensure 1097 * that the monitor gets informed. Ensure that the resulting event 1098 * is only send once by checking if the cookie exists or not. The 1099 * socket cookie will be only ever generated once for the lifetime 1100 * of a given socket. 1101 */ 1102 if (hci_sock_gen_cookie(sk)) { 1103 struct sk_buff *skb; 1104 1105 /* Perform careful checks before setting the HCI_SOCK_TRUSTED 1106 * flag. Make sure that not only the current task but also 1107 * the socket opener has the required capability, since 1108 * privileged programs can be tricked into making ioctl calls 1109 * on HCI sockets, and the socket should not be marked as 1110 * trusted simply because the ioctl caller is privileged. 1111 */ 1112 if (sk_capable(sk, CAP_NET_ADMIN)) 1113 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1114 1115 /* Send event to monitor */ 1116 skb = create_monitor_ctrl_open(sk); 1117 if (skb) { 1118 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1119 HCI_SOCK_TRUSTED, NULL); 1120 kfree_skb(skb); 1121 } 1122 } 1123 1124 release_sock(sk); 1125 1126 switch (cmd) { 1127 case HCIGETDEVLIST: 1128 return hci_get_dev_list(argp); 1129 1130 case HCIGETDEVINFO: 1131 return hci_get_dev_info(argp); 1132 1133 case HCIGETCONNLIST: 1134 return hci_get_conn_list(argp); 1135 1136 case HCIDEVUP: 1137 if (!capable(CAP_NET_ADMIN)) 1138 return -EPERM; 1139 return hci_dev_open(arg); 1140 1141 case HCIDEVDOWN: 1142 if (!capable(CAP_NET_ADMIN)) 1143 return -EPERM; 1144 return hci_dev_close(arg); 1145 1146 case HCIDEVRESET: 1147 if (!capable(CAP_NET_ADMIN)) 1148 return -EPERM; 1149 return hci_dev_reset(arg); 1150 1151 case HCIDEVRESTAT: 1152 if (!capable(CAP_NET_ADMIN)) 1153 return -EPERM; 1154 return hci_dev_reset_stat(arg); 1155 1156 case HCISETSCAN: 1157 case HCISETAUTH: 1158 case HCISETENCRYPT: 1159 case HCISETPTYPE: 1160 case HCISETLINKPOL: 1161 case HCISETLINKMODE: 1162 case HCISETACLMTU: 1163 case HCISETSCOMTU: 1164 if (!capable(CAP_NET_ADMIN)) 1165 return -EPERM; 1166 return hci_dev_cmd(cmd, argp); 1167 1168 case HCIINQUIRY: 1169 return hci_inquiry(argp); 1170 } 1171 1172 lock_sock(sk); 1173 1174 err = hci_sock_bound_ioctl(sk, cmd, arg); 1175 1176 done: 1177 release_sock(sk); 1178 return err; 1179 } 1180 1181 #ifdef CONFIG_COMPAT 1182 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd, 1183 unsigned long arg) 1184 { 1185 switch (cmd) { 1186 case HCIDEVUP: 1187 case HCIDEVDOWN: 1188 case HCIDEVRESET: 1189 case HCIDEVRESTAT: 1190 return hci_sock_ioctl(sock, cmd, arg); 1191 } 1192 1193 return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 1194 } 1195 #endif 1196 1197 static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 1198 int addr_len) 1199 { 1200 struct sockaddr_hci haddr; 1201 struct sock *sk = sock->sk; 1202 struct hci_dev *hdev = NULL; 1203 struct sk_buff *skb; 1204 int len, err = 0; 1205 1206 BT_DBG("sock %p sk %p", sock, sk); 1207 1208 if (!addr) 1209 return -EINVAL; 1210 1211 memset(&haddr, 0, sizeof(haddr)); 1212 len = min_t(unsigned int, sizeof(haddr), addr_len); 1213 memcpy(&haddr, addr, len); 1214 1215 if (haddr.hci_family != AF_BLUETOOTH) 1216 return -EINVAL; 1217 1218 lock_sock(sk); 1219 1220 /* Allow detaching from dead device and attaching to alive device, if 1221 * the caller wants to re-bind (instead of close) this socket in 1222 * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. 1223 */ 1224 hdev = hci_pi(sk)->hdev; 1225 if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 1226 hci_pi(sk)->hdev = NULL; 1227 sk->sk_state = BT_OPEN; 1228 hci_dev_put(hdev); 1229 } 1230 hdev = NULL; 1231 1232 if (sk->sk_state == BT_BOUND) { 1233 err = -EALREADY; 1234 goto done; 1235 } 1236 1237 switch (haddr.hci_channel) { 1238 case HCI_CHANNEL_RAW: 1239 if (hci_pi(sk)->hdev) { 1240 err = -EALREADY; 1241 goto done; 1242 } 1243 1244 if (haddr.hci_dev != HCI_DEV_NONE) { 1245 hdev = hci_dev_get(haddr.hci_dev); 1246 if (!hdev) { 1247 err = -ENODEV; 1248 goto done; 1249 } 1250 1251 atomic_inc(&hdev->promisc); 1252 } 1253 1254 hci_pi(sk)->channel = haddr.hci_channel; 1255 1256 if (!hci_sock_gen_cookie(sk)) { 1257 /* In the case when a cookie has already been assigned, 1258 * then there has been already an ioctl issued against 1259 * an unbound socket and with that triggered an open 1260 * notification. Send a close notification first to 1261 * allow the state transition to bounded. 1262 */ 1263 skb = create_monitor_ctrl_close(sk); 1264 if (skb) { 1265 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1266 HCI_SOCK_TRUSTED, NULL); 1267 kfree_skb(skb); 1268 } 1269 } 1270 1271 if (capable(CAP_NET_ADMIN)) 1272 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1273 1274 hci_pi(sk)->hdev = hdev; 1275 1276 /* Send event to monitor */ 1277 skb = create_monitor_ctrl_open(sk); 1278 if (skb) { 1279 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1280 HCI_SOCK_TRUSTED, NULL); 1281 kfree_skb(skb); 1282 } 1283 break; 1284 1285 case HCI_CHANNEL_USER: 1286 if (hci_pi(sk)->hdev) { 1287 err = -EALREADY; 1288 goto done; 1289 } 1290 1291 if (haddr.hci_dev == HCI_DEV_NONE) { 1292 err = -EINVAL; 1293 goto done; 1294 } 1295 1296 if (!capable(CAP_NET_ADMIN)) { 1297 err = -EPERM; 1298 goto done; 1299 } 1300 1301 hdev = hci_dev_get(haddr.hci_dev); 1302 if (!hdev) { 1303 err = -ENODEV; 1304 goto done; 1305 } 1306 1307 if (test_bit(HCI_INIT, &hdev->flags) || 1308 hci_dev_test_flag(hdev, HCI_SETUP) || 1309 hci_dev_test_flag(hdev, HCI_CONFIG) || 1310 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && 1311 test_bit(HCI_UP, &hdev->flags))) { 1312 err = -EBUSY; 1313 hci_dev_put(hdev); 1314 goto done; 1315 } 1316 1317 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) { 1318 err = -EUSERS; 1319 hci_dev_put(hdev); 1320 goto done; 1321 } 1322 1323 hci_dev_lock(hdev); 1324 mgmt_index_removed(hdev); 1325 hci_dev_unlock(hdev); 1326 1327 err = hci_dev_open(hdev->id); 1328 if (err) { 1329 if (err == -EALREADY) { 1330 /* In case the transport is already up and 1331 * running, clear the error here. 1332 * 1333 * This can happen when opening a user 1334 * channel and HCI_AUTO_OFF grace period 1335 * is still active. 1336 */ 1337 err = 0; 1338 } else { 1339 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 1340 mgmt_index_added(hdev); 1341 hci_dev_put(hdev); 1342 goto done; 1343 } 1344 } 1345 1346 hci_pi(sk)->channel = haddr.hci_channel; 1347 1348 if (!hci_sock_gen_cookie(sk)) { 1349 /* In the case when a cookie has already been assigned, 1350 * this socket will transition from a raw socket into 1351 * a user channel socket. For a clean transition, send 1352 * the close notification first. 1353 */ 1354 skb = create_monitor_ctrl_close(sk); 1355 if (skb) { 1356 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1357 HCI_SOCK_TRUSTED, NULL); 1358 kfree_skb(skb); 1359 } 1360 } 1361 1362 /* The user channel is restricted to CAP_NET_ADMIN 1363 * capabilities and with that implicitly trusted. 1364 */ 1365 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1366 1367 hci_pi(sk)->hdev = hdev; 1368 1369 /* Send event to monitor */ 1370 skb = create_monitor_ctrl_open(sk); 1371 if (skb) { 1372 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1373 HCI_SOCK_TRUSTED, NULL); 1374 kfree_skb(skb); 1375 } 1376 1377 atomic_inc(&hdev->promisc); 1378 break; 1379 1380 case HCI_CHANNEL_MONITOR: 1381 if (haddr.hci_dev != HCI_DEV_NONE) { 1382 err = -EINVAL; 1383 goto done; 1384 } 1385 1386 if (!capable(CAP_NET_RAW)) { 1387 err = -EPERM; 1388 goto done; 1389 } 1390 1391 hci_pi(sk)->channel = haddr.hci_channel; 1392 1393 /* The monitor interface is restricted to CAP_NET_RAW 1394 * capabilities and with that implicitly trusted. 1395 */ 1396 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1397 1398 send_monitor_note(sk, "Linux version %s (%s)", 1399 init_utsname()->release, 1400 init_utsname()->machine); 1401 send_monitor_note(sk, "Bluetooth subsystem version %u.%u", 1402 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION); 1403 send_monitor_replay(sk); 1404 send_monitor_control_replay(sk); 1405 1406 atomic_inc(&monitor_promisc); 1407 break; 1408 1409 case HCI_CHANNEL_LOGGING: 1410 if (haddr.hci_dev != HCI_DEV_NONE) { 1411 err = -EINVAL; 1412 goto done; 1413 } 1414 1415 if (!capable(CAP_NET_ADMIN)) { 1416 err = -EPERM; 1417 goto done; 1418 } 1419 1420 hci_pi(sk)->channel = haddr.hci_channel; 1421 break; 1422 1423 default: 1424 if (!hci_mgmt_chan_find(haddr.hci_channel)) { 1425 err = -EINVAL; 1426 goto done; 1427 } 1428 1429 if (haddr.hci_dev != HCI_DEV_NONE) { 1430 err = -EINVAL; 1431 goto done; 1432 } 1433 1434 /* Users with CAP_NET_ADMIN capabilities are allowed 1435 * access to all management commands and events. For 1436 * untrusted users the interface is restricted and 1437 * also only untrusted events are sent. 1438 */ 1439 if (capable(CAP_NET_ADMIN)) 1440 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1441 1442 hci_pi(sk)->channel = haddr.hci_channel; 1443 1444 /* At the moment the index and unconfigured index events 1445 * are enabled unconditionally. Setting them on each 1446 * socket when binding keeps this functionality. They 1447 * however might be cleared later and then sending of these 1448 * events will be disabled, but that is then intentional. 1449 * 1450 * This also enables generic events that are safe to be 1451 * received by untrusted users. Example for such events 1452 * are changes to settings, class of device, name etc. 1453 */ 1454 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) { 1455 if (!hci_sock_gen_cookie(sk)) { 1456 /* In the case when a cookie has already been 1457 * assigned, this socket will transition from 1458 * a raw socket into a control socket. To 1459 * allow for a clean transition, send the 1460 * close notification first. 1461 */ 1462 skb = create_monitor_ctrl_close(sk); 1463 if (skb) { 1464 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1465 HCI_SOCK_TRUSTED, NULL); 1466 kfree_skb(skb); 1467 } 1468 } 1469 1470 /* Send event to monitor */ 1471 skb = create_monitor_ctrl_open(sk); 1472 if (skb) { 1473 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1474 HCI_SOCK_TRUSTED, NULL); 1475 kfree_skb(skb); 1476 } 1477 1478 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS); 1479 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 1480 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS); 1481 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS); 1482 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1483 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1484 } 1485 break; 1486 } 1487 1488 /* Default MTU to HCI_MAX_FRAME_SIZE if not set */ 1489 if (!hci_pi(sk)->mtu) 1490 hci_pi(sk)->mtu = HCI_MAX_FRAME_SIZE; 1491 1492 sk->sk_state = BT_BOUND; 1493 1494 done: 1495 release_sock(sk); 1496 return err; 1497 } 1498 1499 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, 1500 int peer) 1501 { 1502 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr; 1503 struct sock *sk = sock->sk; 1504 struct hci_dev *hdev; 1505 int err = 0; 1506 1507 BT_DBG("sock %p sk %p", sock, sk); 1508 1509 if (peer) 1510 return -EOPNOTSUPP; 1511 1512 lock_sock(sk); 1513 1514 hdev = hci_hdev_from_sock(sk); 1515 if (IS_ERR(hdev)) { 1516 err = PTR_ERR(hdev); 1517 goto done; 1518 } 1519 1520 haddr->hci_family = AF_BLUETOOTH; 1521 haddr->hci_dev = hdev->id; 1522 haddr->hci_channel= hci_pi(sk)->channel; 1523 err = sizeof(*haddr); 1524 1525 done: 1526 release_sock(sk); 1527 return err; 1528 } 1529 1530 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, 1531 struct sk_buff *skb) 1532 { 1533 __u8 mask = hci_pi(sk)->cmsg_mask; 1534 1535 if (mask & HCI_CMSG_DIR) { 1536 int incoming = bt_cb(skb)->incoming; 1537 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), 1538 &incoming); 1539 } 1540 1541 if (mask & HCI_CMSG_TSTAMP) { 1542 #ifdef CONFIG_COMPAT 1543 struct old_timeval32 ctv; 1544 #endif 1545 struct __kernel_old_timeval tv; 1546 void *data; 1547 int len; 1548 1549 skb_get_timestamp(skb, &tv); 1550 1551 data = &tv; 1552 len = sizeof(tv); 1553 #ifdef CONFIG_COMPAT 1554 if (!COMPAT_USE_64BIT_TIME && 1555 (msg->msg_flags & MSG_CMSG_COMPAT)) { 1556 ctv.tv_sec = tv.tv_sec; 1557 ctv.tv_usec = tv.tv_usec; 1558 data = &ctv; 1559 len = sizeof(ctv); 1560 } 1561 #endif 1562 1563 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 1564 } 1565 } 1566 1567 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1568 size_t len, int flags) 1569 { 1570 struct scm_cookie scm; 1571 struct sock *sk = sock->sk; 1572 struct sk_buff *skb; 1573 int copied, err; 1574 unsigned int skblen; 1575 1576 BT_DBG("sock %p, sk %p", sock, sk); 1577 1578 if (flags & MSG_OOB) 1579 return -EOPNOTSUPP; 1580 1581 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING) 1582 return -EOPNOTSUPP; 1583 1584 if (sk->sk_state == BT_CLOSED) 1585 return 0; 1586 1587 skb = skb_recv_datagram(sk, flags, &err); 1588 if (!skb) 1589 return err; 1590 1591 skblen = skb->len; 1592 copied = skb->len; 1593 if (len < copied) { 1594 msg->msg_flags |= MSG_TRUNC; 1595 copied = len; 1596 } 1597 1598 skb_reset_transport_header(skb); 1599 err = skb_copy_datagram_msg(skb, 0, msg, copied); 1600 1601 switch (hci_pi(sk)->channel) { 1602 case HCI_CHANNEL_RAW: 1603 hci_sock_cmsg(sk, msg, skb); 1604 break; 1605 case HCI_CHANNEL_USER: 1606 case HCI_CHANNEL_MONITOR: 1607 sock_recv_timestamp(msg, sk, skb); 1608 break; 1609 default: 1610 if (hci_mgmt_chan_find(hci_pi(sk)->channel)) 1611 sock_recv_timestamp(msg, sk, skb); 1612 break; 1613 } 1614 1615 memset(&scm, 0, sizeof(scm)); 1616 scm.creds = bt_cb(skb)->creds; 1617 1618 skb_free_datagram(sk, skb); 1619 1620 if (flags & MSG_TRUNC) 1621 copied = skblen; 1622 1623 scm_recv(sock, msg, &scm, flags); 1624 1625 return err ? : copied; 1626 } 1627 1628 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 1629 struct sk_buff *skb) 1630 { 1631 u8 *cp; 1632 struct mgmt_hdr *hdr; 1633 u16 opcode, index, len; 1634 struct hci_dev *hdev = NULL; 1635 const struct hci_mgmt_handler *handler; 1636 bool var_len, no_hdev; 1637 int err; 1638 1639 BT_DBG("got %d bytes", skb->len); 1640 1641 if (skb->len < sizeof(*hdr)) 1642 return -EINVAL; 1643 1644 hdr = (void *)skb->data; 1645 opcode = __le16_to_cpu(hdr->opcode); 1646 index = __le16_to_cpu(hdr->index); 1647 len = __le16_to_cpu(hdr->len); 1648 1649 if (len != skb->len - sizeof(*hdr)) { 1650 err = -EINVAL; 1651 goto done; 1652 } 1653 1654 if (chan->channel == HCI_CHANNEL_CONTROL) { 1655 struct sk_buff *cmd; 1656 1657 /* Send event to monitor */ 1658 cmd = create_monitor_ctrl_command(sk, index, opcode, len, 1659 skb->data + sizeof(*hdr)); 1660 if (cmd) { 1661 hci_send_to_channel(HCI_CHANNEL_MONITOR, cmd, 1662 HCI_SOCK_TRUSTED, NULL); 1663 kfree_skb(cmd); 1664 } 1665 } 1666 1667 if (opcode >= chan->handler_count || 1668 chan->handlers[opcode].func == NULL) { 1669 BT_DBG("Unknown op %u", opcode); 1670 err = mgmt_cmd_status(sk, index, opcode, 1671 MGMT_STATUS_UNKNOWN_COMMAND); 1672 goto done; 1673 } 1674 1675 handler = &chan->handlers[opcode]; 1676 1677 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) && 1678 !(handler->flags & HCI_MGMT_UNTRUSTED)) { 1679 err = mgmt_cmd_status(sk, index, opcode, 1680 MGMT_STATUS_PERMISSION_DENIED); 1681 goto done; 1682 } 1683 1684 if (index != MGMT_INDEX_NONE) { 1685 hdev = hci_dev_get(index); 1686 if (!hdev) { 1687 err = mgmt_cmd_status(sk, index, opcode, 1688 MGMT_STATUS_INVALID_INDEX); 1689 goto done; 1690 } 1691 1692 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1693 hci_dev_test_flag(hdev, HCI_CONFIG) || 1694 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1695 err = mgmt_cmd_status(sk, index, opcode, 1696 MGMT_STATUS_INVALID_INDEX); 1697 goto done; 1698 } 1699 1700 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1701 !(handler->flags & HCI_MGMT_UNCONFIGURED)) { 1702 err = mgmt_cmd_status(sk, index, opcode, 1703 MGMT_STATUS_INVALID_INDEX); 1704 goto done; 1705 } 1706 } 1707 1708 if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) { 1709 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV); 1710 if (no_hdev != !hdev) { 1711 err = mgmt_cmd_status(sk, index, opcode, 1712 MGMT_STATUS_INVALID_INDEX); 1713 goto done; 1714 } 1715 } 1716 1717 var_len = (handler->flags & HCI_MGMT_VAR_LEN); 1718 if ((var_len && len < handler->data_len) || 1719 (!var_len && len != handler->data_len)) { 1720 err = mgmt_cmd_status(sk, index, opcode, 1721 MGMT_STATUS_INVALID_PARAMS); 1722 goto done; 1723 } 1724 1725 if (hdev && chan->hdev_init) 1726 chan->hdev_init(sk, hdev); 1727 1728 cp = skb->data + sizeof(*hdr); 1729 1730 err = handler->func(sk, hdev, cp, len); 1731 if (err < 0) 1732 goto done; 1733 1734 err = skb->len; 1735 1736 done: 1737 if (hdev) 1738 hci_dev_put(hdev); 1739 1740 return err; 1741 } 1742 1743 static int hci_logging_frame(struct sock *sk, struct sk_buff *skb, 1744 unsigned int flags) 1745 { 1746 struct hci_mon_hdr *hdr; 1747 struct hci_dev *hdev; 1748 u16 index; 1749 int err; 1750 1751 /* The logging frame consists at minimum of the standard header, 1752 * the priority byte, the ident length byte and at least one string 1753 * terminator NUL byte. Anything shorter are invalid packets. 1754 */ 1755 if (skb->len < sizeof(*hdr) + 3) 1756 return -EINVAL; 1757 1758 hdr = (void *)skb->data; 1759 1760 if (__le16_to_cpu(hdr->len) != skb->len - sizeof(*hdr)) 1761 return -EINVAL; 1762 1763 if (__le16_to_cpu(hdr->opcode) == 0x0000) { 1764 __u8 priority = skb->data[sizeof(*hdr)]; 1765 __u8 ident_len = skb->data[sizeof(*hdr) + 1]; 1766 1767 /* Only the priorities 0-7 are valid and with that any other 1768 * value results in an invalid packet. 1769 * 1770 * The priority byte is followed by an ident length byte and 1771 * the NUL terminated ident string. Check that the ident 1772 * length is not overflowing the packet and also that the 1773 * ident string itself is NUL terminated. In case the ident 1774 * length is zero, the length value actually doubles as NUL 1775 * terminator identifier. 1776 * 1777 * The message follows the ident string (if present) and 1778 * must be NUL terminated. Otherwise it is not a valid packet. 1779 */ 1780 if (priority > 7 || skb->data[skb->len - 1] != 0x00 || 1781 ident_len > skb->len - sizeof(*hdr) - 3 || 1782 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) 1783 return -EINVAL; 1784 } else { 1785 return -EINVAL; 1786 } 1787 1788 index = __le16_to_cpu(hdr->index); 1789 1790 if (index != MGMT_INDEX_NONE) { 1791 hdev = hci_dev_get(index); 1792 if (!hdev) 1793 return -ENODEV; 1794 } else { 1795 hdev = NULL; 1796 } 1797 1798 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING); 1799 1800 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL); 1801 err = skb->len; 1802 1803 if (hdev) 1804 hci_dev_put(hdev); 1805 1806 return err; 1807 } 1808 1809 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1810 size_t len) 1811 { 1812 struct sock *sk = sock->sk; 1813 struct hci_mgmt_chan *chan; 1814 struct hci_dev *hdev; 1815 struct sk_buff *skb; 1816 int err; 1817 const unsigned int flags = msg->msg_flags; 1818 1819 BT_DBG("sock %p sk %p", sock, sk); 1820 1821 if (flags & MSG_OOB) 1822 return -EOPNOTSUPP; 1823 1824 if (flags & ~(MSG_DONTWAIT | MSG_NOSIGNAL | MSG_ERRQUEUE | MSG_CMSG_COMPAT)) 1825 return -EINVAL; 1826 1827 if (len < 4 || len > hci_pi(sk)->mtu) 1828 return -EINVAL; 1829 1830 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 1831 if (IS_ERR(skb)) 1832 return PTR_ERR(skb); 1833 1834 lock_sock(sk); 1835 1836 switch (hci_pi(sk)->channel) { 1837 case HCI_CHANNEL_RAW: 1838 case HCI_CHANNEL_USER: 1839 break; 1840 case HCI_CHANNEL_MONITOR: 1841 err = -EOPNOTSUPP; 1842 goto drop; 1843 case HCI_CHANNEL_LOGGING: 1844 err = hci_logging_frame(sk, skb, flags); 1845 goto drop; 1846 default: 1847 mutex_lock(&mgmt_chan_list_lock); 1848 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel); 1849 if (chan) 1850 err = hci_mgmt_cmd(chan, sk, skb); 1851 else 1852 err = -EINVAL; 1853 1854 mutex_unlock(&mgmt_chan_list_lock); 1855 goto drop; 1856 } 1857 1858 hdev = hci_hdev_from_sock(sk); 1859 if (IS_ERR(hdev)) { 1860 err = PTR_ERR(hdev); 1861 goto drop; 1862 } 1863 1864 if (!test_bit(HCI_UP, &hdev->flags)) { 1865 err = -ENETDOWN; 1866 goto drop; 1867 } 1868 1869 hci_skb_pkt_type(skb) = skb->data[0]; 1870 skb_pull(skb, 1); 1871 1872 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 1873 /* No permission check is needed for user channel 1874 * since that gets enforced when binding the socket. 1875 * 1876 * However check that the packet type is valid. 1877 */ 1878 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 1879 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1880 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1881 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT && 1882 hci_skb_pkt_type(skb) != HCI_DRV_PKT) { 1883 err = -EINVAL; 1884 goto drop; 1885 } 1886 1887 skb_queue_tail(&hdev->raw_q, skb); 1888 queue_work(hdev->workqueue, &hdev->tx_work); 1889 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) { 1890 u16 opcode = get_unaligned_le16(skb->data); 1891 u16 ogf = hci_opcode_ogf(opcode); 1892 u16 ocf = hci_opcode_ocf(opcode); 1893 1894 if (((ogf > HCI_SFLT_MAX_OGF) || 1895 (ocf > HCI_FLT_OCF_BITS) || 1896 !hci_test_bit(ocf, 1897 &hci_sec_filter.ocf_mask[ogf])) && 1898 !capable(CAP_NET_RAW)) { 1899 err = -EPERM; 1900 goto drop; 1901 } 1902 1903 /* Since the opcode has already been extracted here, store 1904 * a copy of the value for later use by the drivers. 1905 */ 1906 hci_skb_opcode(skb) = opcode; 1907 1908 if (ogf == 0x3f) { 1909 skb_queue_tail(&hdev->raw_q, skb); 1910 queue_work(hdev->workqueue, &hdev->tx_work); 1911 } else { 1912 /* Stand-alone HCI commands must be flagged as 1913 * single-command requests. 1914 */ 1915 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 1916 1917 skb_queue_tail(&hdev->cmd_q, skb); 1918 queue_work(hdev->workqueue, &hdev->cmd_work); 1919 } 1920 } else { 1921 if (!capable(CAP_NET_RAW)) { 1922 err = -EPERM; 1923 goto drop; 1924 } 1925 1926 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1927 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1928 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { 1929 err = -EINVAL; 1930 goto drop; 1931 } 1932 1933 skb_queue_tail(&hdev->raw_q, skb); 1934 queue_work(hdev->workqueue, &hdev->tx_work); 1935 } 1936 1937 err = len; 1938 1939 done: 1940 release_sock(sk); 1941 return err; 1942 1943 drop: 1944 kfree_skb(skb); 1945 goto done; 1946 } 1947 1948 static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname, 1949 sockptr_t optval, unsigned int optlen) 1950 { 1951 struct hci_ufilter uf = { .opcode = 0 }; 1952 struct sock *sk = sock->sk; 1953 int err = 0, opt = 0; 1954 1955 BT_DBG("sk %p, opt %d", sk, optname); 1956 1957 lock_sock(sk); 1958 1959 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1960 err = -EBADFD; 1961 goto done; 1962 } 1963 1964 switch (optname) { 1965 case HCI_DATA_DIR: 1966 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1967 if (err) 1968 break; 1969 1970 if (opt) 1971 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 1972 else 1973 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 1974 break; 1975 1976 case HCI_TIME_STAMP: 1977 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1978 if (err) 1979 break; 1980 1981 if (opt) 1982 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 1983 else 1984 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 1985 break; 1986 1987 case HCI_FILTER: 1988 { 1989 struct hci_filter *f = &hci_pi(sk)->filter; 1990 1991 uf.type_mask = f->type_mask; 1992 uf.opcode = f->opcode; 1993 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1994 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1995 } 1996 1997 err = copy_safe_from_sockptr(&uf, sizeof(uf), optval, optlen); 1998 if (err) 1999 break; 2000 2001 if (!capable(CAP_NET_RAW)) { 2002 uf.type_mask &= hci_sec_filter.type_mask; 2003 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 2004 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 2005 } 2006 2007 { 2008 struct hci_filter *f = &hci_pi(sk)->filter; 2009 2010 f->type_mask = uf.type_mask; 2011 f->opcode = uf.opcode; 2012 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 2013 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 2014 } 2015 break; 2016 2017 default: 2018 err = -ENOPROTOOPT; 2019 break; 2020 } 2021 2022 done: 2023 release_sock(sk); 2024 return err; 2025 } 2026 2027 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 2028 sockptr_t optval, unsigned int optlen) 2029 { 2030 struct sock *sk = sock->sk; 2031 int err = 0; 2032 u16 opt; 2033 2034 BT_DBG("sk %p, opt %d", sk, optname); 2035 2036 if (level == SOL_HCI) 2037 return hci_sock_setsockopt_old(sock, level, optname, optval, 2038 optlen); 2039 2040 if (level != SOL_BLUETOOTH) 2041 return -ENOPROTOOPT; 2042 2043 lock_sock(sk); 2044 2045 switch (optname) { 2046 case BT_SNDMTU: 2047 case BT_RCVMTU: 2048 switch (hci_pi(sk)->channel) { 2049 /* Don't allow changing MTU for channels that are meant for HCI 2050 * traffic only. 2051 */ 2052 case HCI_CHANNEL_RAW: 2053 case HCI_CHANNEL_USER: 2054 err = -ENOPROTOOPT; 2055 goto done; 2056 } 2057 2058 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 2059 if (err) 2060 break; 2061 2062 hci_pi(sk)->mtu = opt; 2063 break; 2064 2065 default: 2066 err = -ENOPROTOOPT; 2067 break; 2068 } 2069 2070 done: 2071 release_sock(sk); 2072 return err; 2073 } 2074 2075 static int hci_sock_getsockopt_old(struct socket *sock, int level, int optname, 2076 sockopt_t *sopt) 2077 { 2078 struct hci_ufilter uf; 2079 struct sock *sk = sock->sk; 2080 int len, opt, err = 0; 2081 2082 BT_DBG("sk %p, opt %d", sk, optname); 2083 2084 len = sopt->optlen; 2085 2086 lock_sock(sk); 2087 2088 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 2089 err = -EBADFD; 2090 goto done; 2091 } 2092 2093 switch (optname) { 2094 case HCI_DATA_DIR: 2095 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 2096 opt = 1; 2097 else 2098 opt = 0; 2099 2100 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2101 sizeof(opt)) 2102 err = -EFAULT; 2103 break; 2104 2105 case HCI_TIME_STAMP: 2106 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 2107 opt = 1; 2108 else 2109 opt = 0; 2110 2111 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 2112 sizeof(opt)) 2113 err = -EFAULT; 2114 break; 2115 2116 case HCI_FILTER: 2117 { 2118 struct hci_filter *f = &hci_pi(sk)->filter; 2119 2120 memset(&uf, 0, sizeof(uf)); 2121 uf.type_mask = f->type_mask; 2122 uf.opcode = f->opcode; 2123 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 2124 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 2125 } 2126 2127 len = min_t(unsigned int, len, sizeof(uf)); 2128 if (copy_to_iter(&uf, len, &sopt->iter_out) != len) 2129 err = -EFAULT; 2130 break; 2131 2132 default: 2133 err = -ENOPROTOOPT; 2134 break; 2135 } 2136 2137 done: 2138 release_sock(sk); 2139 return err; 2140 } 2141 2142 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, 2143 sockopt_t *sopt) 2144 { 2145 struct sock *sk = sock->sk; 2146 int err = 0; 2147 u16 mtu; 2148 2149 BT_DBG("sk %p, opt %d", sk, optname); 2150 2151 if (level == SOL_HCI) 2152 return hci_sock_getsockopt_old(sock, level, optname, sopt); 2153 2154 if (level != SOL_BLUETOOTH) 2155 return -ENOPROTOOPT; 2156 2157 lock_sock(sk); 2158 2159 switch (optname) { 2160 case BT_SNDMTU: 2161 case BT_RCVMTU: 2162 mtu = hci_pi(sk)->mtu; 2163 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 2164 sizeof(mtu)) 2165 err = -EFAULT; 2166 break; 2167 2168 default: 2169 err = -ENOPROTOOPT; 2170 break; 2171 } 2172 2173 release_sock(sk); 2174 return err; 2175 } 2176 2177 static void hci_sock_destruct(struct sock *sk) 2178 { 2179 mgmt_cleanup(sk); 2180 skb_queue_purge(&sk->sk_receive_queue); 2181 skb_queue_purge(&sk->sk_write_queue); 2182 skb_queue_purge(&sk->sk_error_queue); 2183 } 2184 2185 static const struct proto_ops hci_sock_ops = { 2186 .family = PF_BLUETOOTH, 2187 .owner = THIS_MODULE, 2188 .release = hci_sock_release, 2189 .bind = hci_sock_bind, 2190 .getname = hci_sock_getname, 2191 .sendmsg = hci_sock_sendmsg, 2192 .recvmsg = hci_sock_recvmsg, 2193 .ioctl = hci_sock_ioctl, 2194 #ifdef CONFIG_COMPAT 2195 .compat_ioctl = hci_sock_compat_ioctl, 2196 #endif 2197 .poll = datagram_poll, 2198 .listen = sock_no_listen, 2199 .shutdown = sock_no_shutdown, 2200 .setsockopt = hci_sock_setsockopt, 2201 .getsockopt_iter = hci_sock_getsockopt, 2202 .connect = sock_no_connect, 2203 .socketpair = sock_no_socketpair, 2204 .accept = sock_no_accept, 2205 .mmap = sock_no_mmap 2206 }; 2207 2208 static struct proto hci_sk_proto = { 2209 .name = "HCI", 2210 .owner = THIS_MODULE, 2211 .obj_size = sizeof(struct hci_pinfo) 2212 }; 2213 2214 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 2215 int kern) 2216 { 2217 struct sock *sk; 2218 2219 BT_DBG("sock %p", sock); 2220 2221 if (sock->type != SOCK_RAW) 2222 return -ESOCKTNOSUPPORT; 2223 2224 sock->ops = &hci_sock_ops; 2225 2226 sk = bt_sock_alloc(net, sock, &hci_sk_proto, protocol, GFP_ATOMIC, 2227 kern); 2228 if (!sk) 2229 return -ENOMEM; 2230 2231 sock->state = SS_UNCONNECTED; 2232 sk->sk_destruct = hci_sock_destruct; 2233 2234 bt_sock_link(&hci_sk_list, sk); 2235 return 0; 2236 } 2237 2238 static const struct net_proto_family hci_sock_family_ops = { 2239 .family = PF_BLUETOOTH, 2240 .owner = THIS_MODULE, 2241 .create = hci_sock_create, 2242 }; 2243 2244 int __init hci_sock_init(void) 2245 { 2246 int err; 2247 2248 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr)); 2249 2250 err = proto_register(&hci_sk_proto, 0); 2251 if (err < 0) 2252 return err; 2253 2254 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 2255 if (err < 0) { 2256 BT_ERR("HCI socket registration failed"); 2257 goto error; 2258 } 2259 2260 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL); 2261 if (err < 0) { 2262 BT_ERR("Failed to create HCI proc file"); 2263 bt_sock_unregister(BTPROTO_HCI); 2264 goto error; 2265 } 2266 2267 BT_INFO("HCI socket layer initialized"); 2268 2269 return 0; 2270 2271 error: 2272 proto_unregister(&hci_sk_proto); 2273 return err; 2274 } 2275 2276 void hci_sock_cleanup(void) 2277 { 2278 bt_procfs_cleanup(&init_net, "hci"); 2279 bt_sock_unregister(BTPROTO_HCI); 2280 proto_unregister(&hci_sk_proto); 2281 } 2282