1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * RFCOMM sockets. 23 */ 24 #include <linux/compat.h> 25 #include <linux/export.h> 26 #include <linux/debugfs.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 static const struct proto_ops rfcomm_sock_ops; 36 37 static struct bt_sock_list rfcomm_sk_list = { 38 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 39 }; 40 41 static void rfcomm_sock_close(struct sock *sk); 42 static void rfcomm_sock_kill(struct sock *sk); 43 44 /* ---- DLC callbacks ---- 45 * 46 * called under rfcomm_dlc_lock() 47 */ 48 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 49 { 50 struct sock *sk = d->owner; 51 if (!sk) 52 return; 53 54 atomic_add(skb->len, &sk->sk_rmem_alloc); 55 skb_queue_tail(&sk->sk_receive_queue, skb); 56 sk->sk_data_ready(sk); 57 58 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 59 rfcomm_dlc_throttle(d); 60 } 61 62 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 63 __must_hold(&d->lock) 64 { 65 struct sock *sk = d->owner, *parent; 66 67 if (!sk) 68 return; 69 70 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 71 72 lock_sock(sk); 73 74 if (err) 75 sk->sk_err = err; 76 77 sk->sk_state = d->state; 78 79 parent = bt_sk(sk)->parent; 80 if (parent) { 81 if (d->state == BT_CLOSED) { 82 sock_set_flag(sk, SOCK_ZAPPED); 83 bt_accept_unlink(sk); 84 } 85 parent->sk_data_ready(parent); 86 } else { 87 if (d->state == BT_CONNECTED) 88 rfcomm_session_getaddr(d->session, 89 &rfcomm_pi(sk)->src, NULL); 90 sk->sk_state_change(sk); 91 } 92 93 release_sock(sk); 94 95 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 96 /* We have to drop DLC lock here, otherwise 97 * rfcomm_sock_destruct() will dead lock. */ 98 rfcomm_dlc_unlock(d); 99 rfcomm_sock_kill(sk); 100 rfcomm_dlc_lock(d); 101 } 102 } 103 104 /* ---- Socket functions ---- */ 105 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 106 { 107 struct sock *sk = NULL; 108 109 sk_for_each(sk, &rfcomm_sk_list.head) { 110 if (rfcomm_pi(sk)->channel != channel) 111 continue; 112 113 if (bacmp(&rfcomm_pi(sk)->src, src)) 114 continue; 115 116 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 117 break; 118 } 119 120 return sk ? sk : NULL; 121 } 122 123 /* Find socket with channel and source bdaddr. 124 * Returns closest match with an extra reference held. 125 */ 126 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 127 { 128 struct sock *sk = NULL, *sk1 = NULL; 129 130 read_lock(&rfcomm_sk_list.lock); 131 132 sk_for_each(sk, &rfcomm_sk_list.head) { 133 if (state && sk->sk_state != state) 134 continue; 135 136 if (rfcomm_pi(sk)->channel == channel) { 137 /* Exact match. */ 138 if (!bacmp(&rfcomm_pi(sk)->src, src)) { 139 sock_hold(sk); 140 break; 141 } 142 143 /* Closest match */ 144 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) { 145 if (sk1) 146 sock_put(sk1); 147 148 sk1 = sk; 149 sock_hold(sk1); 150 } 151 } 152 } 153 154 if (sk && sk1) 155 sock_put(sk1); 156 157 read_unlock(&rfcomm_sk_list.lock); 158 159 return sk ? sk : sk1; 160 } 161 162 static void rfcomm_sock_destruct(struct sock *sk) 163 { 164 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 165 166 BT_DBG("sk %p dlc %p", sk, d); 167 168 skb_queue_purge(&sk->sk_receive_queue); 169 skb_queue_purge(&sk->sk_write_queue); 170 171 rfcomm_dlc_lock(d); 172 rfcomm_pi(sk)->dlc = NULL; 173 174 /* Detach DLC if it's owned by this socket */ 175 if (d->owner == sk) 176 d->owner = NULL; 177 rfcomm_dlc_unlock(d); 178 179 rfcomm_dlc_put(d); 180 } 181 182 static void rfcomm_sock_cleanup_listen(struct sock *parent) 183 { 184 struct sock *sk; 185 186 BT_DBG("parent %p", parent); 187 188 /* Close not yet accepted dlcs */ 189 while ((sk = bt_accept_dequeue(parent, NULL))) { 190 rfcomm_sock_close(sk); 191 rfcomm_sock_kill(sk); 192 /* Drop the reference handed back by bt_accept_dequeue(). */ 193 sock_put(sk); 194 } 195 196 parent->sk_state = BT_CLOSED; 197 sock_set_flag(parent, SOCK_ZAPPED); 198 } 199 200 /* Kill socket (only if zapped and orphan) 201 * Must be called on unlocked socket. 202 */ 203 static void rfcomm_sock_kill(struct sock *sk) 204 { 205 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 206 return; 207 208 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 209 210 /* Kill poor orphan */ 211 bt_sock_unlink(&rfcomm_sk_list, sk); 212 sock_set_flag(sk, SOCK_DEAD); 213 sock_put(sk); 214 } 215 216 static void __rfcomm_sock_close(struct sock *sk) 217 { 218 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 219 220 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 221 222 switch (sk->sk_state) { 223 case BT_LISTEN: 224 rfcomm_sock_cleanup_listen(sk); 225 break; 226 227 case BT_CONNECT: 228 case BT_CONNECT2: 229 case BT_CONFIG: 230 case BT_CONNECTED: 231 rfcomm_dlc_close(d, 0); 232 fallthrough; 233 234 default: 235 sock_set_flag(sk, SOCK_ZAPPED); 236 break; 237 } 238 } 239 240 /* Close socket. 241 * Must be called on unlocked socket. 242 */ 243 static void rfcomm_sock_close(struct sock *sk) 244 { 245 lock_sock(sk); 246 __rfcomm_sock_close(sk); 247 release_sock(sk); 248 } 249 250 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 251 { 252 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 253 254 BT_DBG("sk %p", sk); 255 256 if (parent) { 257 sk->sk_type = parent->sk_type; 258 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 259 &bt_sk(parent)->flags); 260 261 pi->sec_level = rfcomm_pi(parent)->sec_level; 262 pi->role_switch = rfcomm_pi(parent)->role_switch; 263 264 security_sk_clone(parent, sk); 265 } else { 266 pi->dlc->defer_setup = 0; 267 268 pi->sec_level = BT_SECURITY_LOW; 269 pi->role_switch = 0; 270 } 271 272 pi->dlc->sec_level = pi->sec_level; 273 pi->dlc->role_switch = pi->role_switch; 274 } 275 276 static struct proto rfcomm_proto = { 277 .name = "RFCOMM", 278 .owner = THIS_MODULE, 279 .obj_size = sizeof(struct rfcomm_pinfo) 280 }; 281 282 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, 283 int proto, gfp_t prio, int kern) 284 { 285 struct rfcomm_dlc *d; 286 struct sock *sk; 287 288 d = rfcomm_dlc_alloc(prio); 289 if (!d) 290 return NULL; 291 292 sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); 293 if (!sk) { 294 rfcomm_dlc_free(d); 295 return NULL; 296 } 297 298 d->data_ready = rfcomm_sk_data_ready; 299 d->state_change = rfcomm_sk_state_change; 300 301 rfcomm_pi(sk)->dlc = d; 302 d->owner = sk; 303 304 sk->sk_destruct = rfcomm_sock_destruct; 305 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 306 307 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 308 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 309 310 bt_sock_link(&rfcomm_sk_list, sk); 311 312 BT_DBG("sk %p", sk); 313 return sk; 314 } 315 316 static int rfcomm_sock_create(struct net *net, struct socket *sock, 317 int protocol, int kern) 318 { 319 struct sock *sk; 320 321 BT_DBG("sock %p", sock); 322 323 sock->state = SS_UNCONNECTED; 324 325 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 326 return -ESOCKTNOSUPPORT; 327 328 sock->ops = &rfcomm_sock_ops; 329 330 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 331 if (!sk) 332 return -ENOMEM; 333 334 rfcomm_sock_init(sk, NULL); 335 return 0; 336 } 337 338 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len) 339 { 340 struct sockaddr_rc sa; 341 struct sock *sk = sock->sk; 342 int len, err = 0; 343 344 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 345 addr->sa_family != AF_BLUETOOTH) 346 return -EINVAL; 347 348 memset(&sa, 0, sizeof(sa)); 349 len = min_t(unsigned int, sizeof(sa), addr_len); 350 memcpy(&sa, addr, len); 351 352 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 353 354 lock_sock(sk); 355 356 if (sk->sk_state != BT_OPEN) { 357 err = -EBADFD; 358 goto done; 359 } 360 361 if (sk->sk_type != SOCK_STREAM) { 362 err = -EINVAL; 363 goto done; 364 } 365 366 write_lock(&rfcomm_sk_list.lock); 367 368 if (sa.rc_channel && 369 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 370 err = -EADDRINUSE; 371 } else { 372 /* Save source address */ 373 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 374 rfcomm_pi(sk)->channel = sa.rc_channel; 375 sk->sk_state = BT_BOUND; 376 } 377 378 write_unlock(&rfcomm_sk_list.lock); 379 380 done: 381 release_sock(sk); 382 return err; 383 } 384 385 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 386 int alen, int flags) 387 { 388 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 389 struct sock *sk = sock->sk; 390 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 391 int err = 0; 392 393 BT_DBG("sk %p", sk); 394 395 if (alen < sizeof(struct sockaddr_rc) || 396 addr->sa_family != AF_BLUETOOTH) 397 return -EINVAL; 398 399 sock_hold(sk); 400 lock_sock(sk); 401 402 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 403 err = -EBADFD; 404 goto done; 405 } 406 407 if (sk->sk_type != SOCK_STREAM) { 408 err = -EINVAL; 409 goto done; 410 } 411 412 sk->sk_state = BT_CONNECT; 413 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 414 rfcomm_pi(sk)->channel = sa->rc_channel; 415 416 d->sec_level = rfcomm_pi(sk)->sec_level; 417 d->role_switch = rfcomm_pi(sk)->role_switch; 418 419 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ 420 release_sock(sk); 421 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 422 sa->rc_channel); 423 lock_sock(sk); 424 if (!err && !sock_flag(sk, SOCK_ZAPPED)) 425 err = bt_sock_wait_state(sk, BT_CONNECTED, 426 sock_sndtimeo(sk, flags & O_NONBLOCK)); 427 428 done: 429 release_sock(sk); 430 sock_put(sk); 431 return err; 432 } 433 434 static int rfcomm_sock_listen(struct socket *sock, int backlog) 435 { 436 struct sock *sk = sock->sk; 437 int err = 0; 438 439 BT_DBG("sk %p backlog %d", sk, backlog); 440 441 lock_sock(sk); 442 443 if (sk->sk_state != BT_BOUND) { 444 err = -EBADFD; 445 goto done; 446 } 447 448 if (sk->sk_type != SOCK_STREAM) { 449 err = -EINVAL; 450 goto done; 451 } 452 453 if (!rfcomm_pi(sk)->channel) { 454 bdaddr_t *src = &rfcomm_pi(sk)->src; 455 u8 channel; 456 457 err = -EINVAL; 458 459 write_lock(&rfcomm_sk_list.lock); 460 461 for (channel = 1; channel < 31; channel++) 462 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 463 rfcomm_pi(sk)->channel = channel; 464 err = 0; 465 break; 466 } 467 468 write_unlock(&rfcomm_sk_list.lock); 469 470 if (err < 0) 471 goto done; 472 } 473 474 sk->sk_max_ack_backlog = backlog; 475 sk->sk_ack_backlog = 0; 476 sk->sk_state = BT_LISTEN; 477 478 done: 479 release_sock(sk); 480 return err; 481 } 482 483 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, 484 struct proto_accept_arg *arg) 485 { 486 DEFINE_WAIT_FUNC(wait, woken_wake_function); 487 struct sock *sk = sock->sk, *nsk; 488 long timeo; 489 int err = 0; 490 491 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 492 493 if (sk->sk_type != SOCK_STREAM) { 494 err = -EINVAL; 495 goto done; 496 } 497 498 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 499 500 BT_DBG("sk %p timeo %ld", sk, timeo); 501 502 /* Wait for an incoming connection. (wake-one). */ 503 add_wait_queue_exclusive(sk_sleep(sk), &wait); 504 while (1) { 505 if (sk->sk_state != BT_LISTEN) { 506 err = -EBADFD; 507 break; 508 } 509 510 nsk = bt_accept_dequeue(sk, newsock); 511 if (nsk) { 512 /* Drop the bridging ref from bt_accept_dequeue(); 513 * the grafted socket keeps nsk alive from here. 514 */ 515 sock_put(nsk); 516 break; 517 } 518 519 if (!timeo) { 520 err = -EAGAIN; 521 break; 522 } 523 524 if (signal_pending(current)) { 525 err = sock_intr_errno(timeo); 526 break; 527 } 528 529 release_sock(sk); 530 531 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 532 533 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 534 } 535 remove_wait_queue(sk_sleep(sk), &wait); 536 537 if (err) 538 goto done; 539 540 newsock->state = SS_CONNECTED; 541 542 BT_DBG("new socket %p", nsk); 543 544 done: 545 release_sock(sk); 546 return err; 547 } 548 549 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 550 { 551 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 552 struct sock *sk = sock->sk; 553 554 BT_DBG("sock %p, sk %p", sock, sk); 555 556 if (peer && sk->sk_state != BT_CONNECTED && 557 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 558 return -ENOTCONN; 559 560 memset(sa, 0, sizeof(*sa)); 561 sa->rc_family = AF_BLUETOOTH; 562 sa->rc_channel = rfcomm_pi(sk)->channel; 563 if (peer) 564 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 565 else 566 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 567 568 return sizeof(struct sockaddr_rc); 569 } 570 571 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 572 size_t len) 573 { 574 struct sock *sk = sock->sk; 575 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 576 struct sk_buff *skb; 577 int sent; 578 579 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 580 return -ENOTCONN; 581 582 if (msg->msg_flags & MSG_OOB) 583 return -EOPNOTSUPP; 584 585 if (sk->sk_shutdown & SEND_SHUTDOWN) 586 return -EPIPE; 587 588 BT_DBG("sock %p, sk %p", sock, sk); 589 590 lock_sock(sk); 591 592 sent = bt_sock_wait_ready(sk, msg->msg_flags); 593 594 release_sock(sk); 595 596 if (sent) 597 return sent; 598 599 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, 600 RFCOMM_SKB_TAIL_RESERVE); 601 if (IS_ERR(skb)) 602 return PTR_ERR(skb); 603 604 sent = rfcomm_dlc_send(d, skb); 605 if (sent < 0) 606 kfree_skb(skb); 607 608 return sent; 609 } 610 611 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 612 size_t size, int flags) 613 { 614 struct sock *sk = sock->sk; 615 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 616 int len; 617 618 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 619 rfcomm_dlc_accept(d); 620 return 0; 621 } 622 623 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 624 625 lock_sock(sk); 626 if (!(flags & MSG_PEEK) && len > 0) 627 atomic_sub(len, &sk->sk_rmem_alloc); 628 629 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 630 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 631 release_sock(sk); 632 633 return len; 634 } 635 636 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 637 sockptr_t optval, unsigned int optlen) 638 { 639 struct sock *sk = sock->sk; 640 int err = 0; 641 u32 opt; 642 643 BT_DBG("sk %p", sk); 644 645 lock_sock(sk); 646 647 switch (optname) { 648 case RFCOMM_LM: 649 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 650 if (err) 651 break; 652 653 if (opt & RFCOMM_LM_FIPS) { 654 err = -EINVAL; 655 break; 656 } 657 658 if (opt & RFCOMM_LM_AUTH) 659 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 660 if (opt & RFCOMM_LM_ENCRYPT) 661 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 662 if (opt & RFCOMM_LM_SECURE) 663 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 664 665 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 666 break; 667 668 default: 669 err = -ENOPROTOOPT; 670 break; 671 } 672 673 release_sock(sk); 674 return err; 675 } 676 677 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 678 sockptr_t optval, unsigned int optlen) 679 { 680 struct sock *sk = sock->sk; 681 struct bt_security sec; 682 int err = 0; 683 u32 opt; 684 685 BT_DBG("sk %p", sk); 686 687 if (level == SOL_RFCOMM) 688 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 689 690 if (level != SOL_BLUETOOTH) 691 return -ENOPROTOOPT; 692 693 lock_sock(sk); 694 695 switch (optname) { 696 case BT_SECURITY: 697 if (sk->sk_type != SOCK_STREAM) { 698 err = -EINVAL; 699 break; 700 } 701 702 sec.level = BT_SECURITY_LOW; 703 704 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 705 if (err) 706 break; 707 708 if (sec.level > BT_SECURITY_HIGH) { 709 err = -EINVAL; 710 break; 711 } 712 713 rfcomm_pi(sk)->sec_level = sec.level; 714 break; 715 716 case BT_DEFER_SETUP: 717 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 718 err = -EINVAL; 719 break; 720 } 721 722 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 723 if (err) 724 break; 725 726 if (opt) 727 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 728 else 729 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 730 731 break; 732 733 default: 734 err = -ENOPROTOOPT; 735 break; 736 } 737 738 release_sock(sk); 739 return err; 740 } 741 742 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, 743 sockopt_t *sopt) 744 { 745 struct sock *sk = sock->sk; 746 struct sock *l2cap_sk; 747 struct l2cap_conn *conn; 748 struct rfcomm_conninfo cinfo; 749 int err = 0; 750 size_t len; 751 u32 opt; 752 753 BT_DBG("sk %p", sk); 754 755 len = sopt->optlen; 756 757 lock_sock(sk); 758 759 switch (optname) { 760 case RFCOMM_LM: 761 switch (rfcomm_pi(sk)->sec_level) { 762 case BT_SECURITY_LOW: 763 opt = RFCOMM_LM_AUTH; 764 break; 765 case BT_SECURITY_MEDIUM: 766 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 767 break; 768 case BT_SECURITY_HIGH: 769 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 770 RFCOMM_LM_SECURE; 771 break; 772 case BT_SECURITY_FIPS: 773 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 774 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 775 break; 776 default: 777 opt = 0; 778 break; 779 } 780 781 if (rfcomm_pi(sk)->role_switch) 782 opt |= RFCOMM_LM_MASTER; 783 784 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 785 sizeof(opt)) 786 err = -EFAULT; 787 788 break; 789 790 case RFCOMM_CONNINFO: 791 if (sk->sk_state != BT_CONNECTED && 792 !rfcomm_pi(sk)->dlc->defer_setup) { 793 err = -ENOTCONN; 794 break; 795 } 796 797 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 798 conn = l2cap_pi(l2cap_sk)->chan->conn; 799 800 memset(&cinfo, 0, sizeof(cinfo)); 801 cinfo.hci_handle = conn->hcon->handle; 802 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 803 804 len = min(len, sizeof(cinfo)); 805 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 806 err = -EFAULT; 807 808 break; 809 810 default: 811 err = -ENOPROTOOPT; 812 break; 813 } 814 815 release_sock(sk); 816 return err; 817 } 818 819 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, 820 sockopt_t *sopt) 821 { 822 struct sock *sk = sock->sk; 823 struct bt_security sec; 824 int err = 0; 825 size_t len; 826 u32 opt; 827 828 BT_DBG("sk %p", sk); 829 830 if (level == SOL_RFCOMM) 831 return rfcomm_sock_getsockopt_old(sock, optname, sopt); 832 833 if (level != SOL_BLUETOOTH) 834 return -ENOPROTOOPT; 835 836 len = sopt->optlen; 837 838 lock_sock(sk); 839 840 switch (optname) { 841 case BT_SECURITY: 842 if (sk->sk_type != SOCK_STREAM) { 843 err = -EINVAL; 844 break; 845 } 846 847 sec.level = rfcomm_pi(sk)->sec_level; 848 sec.key_size = 0; 849 850 len = min(len, sizeof(sec)); 851 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 852 err = -EFAULT; 853 854 break; 855 856 case BT_DEFER_SETUP: 857 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 858 err = -EINVAL; 859 break; 860 } 861 862 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 863 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 864 sizeof(opt)) 865 err = -EFAULT; 866 867 break; 868 869 default: 870 err = -ENOPROTOOPT; 871 break; 872 } 873 874 release_sock(sk); 875 return err; 876 } 877 878 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 879 { 880 struct sock *sk __maybe_unused = sock->sk; 881 int err; 882 883 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 884 885 err = bt_sock_ioctl(sock, cmd, arg); 886 887 if (err == -ENOIOCTLCMD) { 888 #ifdef CONFIG_BT_RFCOMM_TTY 889 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 890 #else 891 err = -EOPNOTSUPP; 892 #endif 893 } 894 895 return err; 896 } 897 898 #ifdef CONFIG_COMPAT 899 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 900 { 901 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 902 } 903 #endif 904 905 static int rfcomm_sock_shutdown(struct socket *sock, int how) 906 { 907 struct sock *sk = sock->sk; 908 int err = 0; 909 910 BT_DBG("sock %p, sk %p", sock, sk); 911 912 if (!sk) 913 return 0; 914 915 lock_sock(sk); 916 if (!sk->sk_shutdown) { 917 sk->sk_shutdown = SHUTDOWN_MASK; 918 919 release_sock(sk); 920 __rfcomm_sock_close(sk); 921 lock_sock(sk); 922 923 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 924 !(current->flags & PF_EXITING)) 925 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 926 } 927 release_sock(sk); 928 return err; 929 } 930 931 static int rfcomm_sock_release(struct socket *sock) 932 { 933 struct sock *sk = sock->sk; 934 int err; 935 936 BT_DBG("sock %p, sk %p", sock, sk); 937 938 if (!sk) 939 return 0; 940 941 err = rfcomm_sock_shutdown(sock, 2); 942 943 sock_orphan(sk); 944 rfcomm_sock_kill(sk); 945 return err; 946 } 947 948 /* ---- RFCOMM core layer callbacks ---- 949 * 950 * called under rfcomm_lock() 951 */ 952 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 953 { 954 struct sock *sk, *parent; 955 bdaddr_t src, dst; 956 bool defer_setup = false; 957 int result = 0; 958 959 BT_DBG("session %p channel %d", s, channel); 960 961 rfcomm_session_getaddr(s, &src, &dst); 962 963 /* Check if we have socket listening on channel */ 964 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 965 if (!parent) 966 return 0; 967 968 lock_sock(parent); 969 970 if (parent->sk_state != BT_LISTEN) 971 goto done; 972 973 defer_setup = test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags); 974 975 /* Check for backlog size */ 976 if (sk_acceptq_is_full(parent)) { 977 BT_DBG("backlog full %d", parent->sk_ack_backlog); 978 goto done; 979 } 980 981 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 982 if (!sk) 983 goto done; 984 985 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 986 987 rfcomm_sock_init(sk, parent); 988 bacpy(&rfcomm_pi(sk)->src, &src); 989 bacpy(&rfcomm_pi(sk)->dst, &dst); 990 rfcomm_pi(sk)->channel = channel; 991 992 sk->sk_state = BT_CONFIG; 993 bt_accept_enqueue(parent, sk, true); 994 995 /* Accept connection and return socket DLC */ 996 *d = rfcomm_pi(sk)->dlc; 997 result = 1; 998 999 done: 1000 release_sock(parent); 1001 1002 if (defer_setup) 1003 parent->sk_state_change(parent); 1004 1005 sock_put(parent); 1006 1007 return result; 1008 } 1009 1010 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1011 { 1012 struct sock *sk; 1013 1014 read_lock(&rfcomm_sk_list.lock); 1015 1016 sk_for_each(sk, &rfcomm_sk_list.head) { 1017 seq_printf(f, "%pMR %pMR %d %d\n", 1018 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1019 sk->sk_state, rfcomm_pi(sk)->channel); 1020 } 1021 1022 read_unlock(&rfcomm_sk_list.lock); 1023 1024 return 0; 1025 } 1026 1027 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs); 1028 1029 static struct dentry *rfcomm_sock_debugfs; 1030 1031 static const struct proto_ops rfcomm_sock_ops = { 1032 .family = PF_BLUETOOTH, 1033 .owner = THIS_MODULE, 1034 .release = rfcomm_sock_release, 1035 .bind = rfcomm_sock_bind, 1036 .connect = rfcomm_sock_connect, 1037 .listen = rfcomm_sock_listen, 1038 .accept = rfcomm_sock_accept, 1039 .getname = rfcomm_sock_getname, 1040 .sendmsg = rfcomm_sock_sendmsg, 1041 .recvmsg = rfcomm_sock_recvmsg, 1042 .shutdown = rfcomm_sock_shutdown, 1043 .setsockopt = rfcomm_sock_setsockopt, 1044 .getsockopt_iter = rfcomm_sock_getsockopt, 1045 .ioctl = rfcomm_sock_ioctl, 1046 .gettstamp = sock_gettstamp, 1047 .poll = bt_sock_poll, 1048 .socketpair = sock_no_socketpair, 1049 .mmap = sock_no_mmap, 1050 #ifdef CONFIG_COMPAT 1051 .compat_ioctl = rfcomm_sock_compat_ioctl, 1052 #endif 1053 }; 1054 1055 static const struct net_proto_family rfcomm_sock_family_ops = { 1056 .family = PF_BLUETOOTH, 1057 .owner = THIS_MODULE, 1058 .create = rfcomm_sock_create 1059 }; 1060 1061 int __init rfcomm_init_sockets(void) 1062 { 1063 int err; 1064 1065 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1066 1067 err = proto_register(&rfcomm_proto, 0); 1068 if (err < 0) 1069 return err; 1070 1071 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1072 if (err < 0) { 1073 BT_ERR("RFCOMM socket layer registration failed"); 1074 goto error; 1075 } 1076 1077 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1078 if (err < 0) { 1079 BT_ERR("Failed to create RFCOMM proc file"); 1080 bt_sock_unregister(BTPROTO_RFCOMM); 1081 goto error; 1082 } 1083 1084 BT_INFO("RFCOMM socket layer initialized"); 1085 1086 if (IS_ERR_OR_NULL(bt_debugfs)) 1087 return 0; 1088 1089 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1090 bt_debugfs, NULL, 1091 &rfcomm_sock_debugfs_fops); 1092 1093 return 0; 1094 1095 error: 1096 proto_unregister(&rfcomm_proto); 1097 return err; 1098 } 1099 1100 void __exit rfcomm_cleanup_sockets(void) 1101 { 1102 bt_procfs_cleanup(&init_net, "rfcomm"); 1103 1104 debugfs_remove(rfcomm_sock_debugfs); 1105 1106 bt_sock_unregister(BTPROTO_RFCOMM); 1107 1108 proto_unregister(&rfcomm_proto); 1109 } 1110