net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/rfcomm.h>
  35
  36 static const struct proto_ops rfcomm_sock_ops;
  37
  38 static struct bt_sock_list rfcomm_sk_list = {
  39         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  40 };
  41
  42 static void rfcomm_sock_close(struct sock *sk);
  43 static void rfcomm_sock_kill(struct sock *sk);
  44
  45 /* ---- DLC callbacks ----
  46  *
  47  * called under rfcomm_dlc_lock()
  48  */
  49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  50 {
  51         struct sock *sk = d->owner;
  52         if (!sk)
  53                 return;
  54
  55         atomic_add(skb->len, &sk->sk_rmem_alloc);
  56         skb_queue_tail(&sk->sk_receive_queue, skb);
  57         sk->sk_data_ready(sk, skb->len);
  58
  59         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  60                 rfcomm_dlc_throttle(d);
  61 }
  62
  63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  64 {
  65         struct sock *sk = d->owner, *parent;
  66         unsigned long flags;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         local_irq_save(flags);
  74         bh_lock_sock(sk);
  75
  76         if (err)
  77                 sk->sk_err = err;
  78
  79         sk->sk_state = d->state;
  80
  81         parent = bt_sk(sk)->parent;
  82         if (parent) {
  83                 if (d->state == BT_CLOSED) {
  84                         sock_set_flag(sk, SOCK_ZAPPED);
  85                         bt_accept_unlink(sk);
  86                 }
  87                 parent->sk_data_ready(parent, 0);
  88         } else {
  89                 if (d->state == BT_CONNECTED)
  90                         rfcomm_session_getaddr(d->session,
  91                                                &rfcomm_pi(sk)->src, NULL);
  92                 sk->sk_state_change(sk);
  93         }
  94
  95         bh_unlock_sock(sk);
  96         local_irq_restore(flags);
  97
  98         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  99                 /* We have to drop DLC lock here, otherwise
 100                  * rfcomm_sock_destruct() will dead lock. */
 101                 rfcomm_dlc_unlock(d);
 102                 rfcomm_sock_kill(sk);
 103                 rfcomm_dlc_lock(d);
 104         }
 105 }
 106
 107 /* ---- Socket functions ---- */
 108 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 109 {
 110         struct sock *sk = NULL;
 111
 112         sk_for_each(sk, &rfcomm_sk_list.head) {
 113                 if (rfcomm_pi(sk)->channel == channel &&
 114                                 !bacmp(&rfcomm_pi(sk)->src, src))
 115                         break;
 116         }
 117
 118         return sk ? sk : NULL;
 119 }
 120
 121 /* Find socket with channel and source bdaddr.
 122  * Returns closest match.
 123  */
 124 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 125 {
 126         struct sock *sk = NULL, *sk1 = NULL;
 127
 128         read_lock(&rfcomm_sk_list.lock);
 129
 130         sk_for_each(sk, &rfcomm_sk_list.head) {
 131                 if (state && sk->sk_state != state)
 132                         continue;
 133
 134                 if (rfcomm_pi(sk)->channel == channel) {
 135                         /* Exact match. */
 136                         if (!bacmp(&rfcomm_pi(sk)->src, src))
 137                                 break;
 138
 139                         /* Closest match */
 140                         if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
 141                                 sk1 = sk;
 142                 }
 143         }
 144
 145         read_unlock(&rfcomm_sk_list.lock);
 146
 147         return sk ? sk : sk1;
 148 }
 149
 150 static void rfcomm_sock_destruct(struct sock *sk)
 151 {
 152         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 153
 154         BT_DBG("sk %p dlc %p", sk, d);
 155
 156         skb_queue_purge(&sk->sk_receive_queue);
 157         skb_queue_purge(&sk->sk_write_queue);
 158
 159         rfcomm_dlc_lock(d);
 160         rfcomm_pi(sk)->dlc = NULL;
 161
 162         /* Detach DLC if it's owned by this socket */
 163         if (d->owner == sk)
 164                 d->owner = NULL;
 165         rfcomm_dlc_unlock(d);
 166
 167         rfcomm_dlc_put(d);
 168 }
 169
 170 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 171 {
 172         struct sock *sk;
 173
 174         BT_DBG("parent %p", parent);
 175
 176         /* Close not yet accepted dlcs */
 177         while ((sk = bt_accept_dequeue(parent, NULL))) {
 178                 rfcomm_sock_close(sk);
 179                 rfcomm_sock_kill(sk);
 180         }
 181
 182         parent->sk_state  = BT_CLOSED;
 183         sock_set_flag(parent, SOCK_ZAPPED);
 184 }
 185
 186 /* Kill socket (only if zapped and orphan)
 187  * Must be called on unlocked socket.
 188  */
 189 static void rfcomm_sock_kill(struct sock *sk)
 190 {
 191         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 192                 return;
 193
 194         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 195
 196         /* Kill poor orphan */
 197         bt_sock_unlink(&rfcomm_sk_list, sk);
 198         sock_set_flag(sk, SOCK_DEAD);
 199         sock_put(sk);
 200 }
 201
 202 static void __rfcomm_sock_close(struct sock *sk)
 203 {
 204         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 205
 206         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 207
 208         switch (sk->sk_state) {
 209         case BT_LISTEN:
 210                 rfcomm_sock_cleanup_listen(sk);
 211                 break;
 212
 213         case BT_CONNECT:
 214         case BT_CONNECT2:
 215         case BT_CONFIG:
 216         case BT_CONNECTED:
 217                 rfcomm_dlc_close(d, 0);
 218
 219         default:
 220                 sock_set_flag(sk, SOCK_ZAPPED);
 221                 break;
 222         }
 223 }
 224
 225 /* Close socket.
 226  * Must be called on unlocked socket.
 227  */
 228 static void rfcomm_sock_close(struct sock *sk)
 229 {
 230         lock_sock(sk);
 231         __rfcomm_sock_close(sk);
 232         release_sock(sk);
 233 }
 234
 235 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 236 {
 237         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 238
 239         BT_DBG("sk %p", sk);
 240
 241         if (parent) {
 242                 sk->sk_type = parent->sk_type;
 243                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 244                                                 &bt_sk(parent)->flags);
 245
 246                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 247                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 248
 249                 security_sk_clone(parent, sk);
 250         } else {
 251                 pi->dlc->defer_setup = 0;
 252
 253                 pi->sec_level = BT_SECURITY_LOW;
 254                 pi->role_switch = 0;
 255         }
 256
 257         pi->dlc->sec_level = pi->sec_level;
 258         pi->dlc->role_switch = pi->role_switch;
 259 }
 260
 261 static struct proto rfcomm_proto = {
 262         .name           = "RFCOMM",
 263         .owner          = THIS_MODULE,
 264         .obj_size       = sizeof(struct rfcomm_pinfo)
 265 };
 266
 267 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 268 {
 269         struct rfcomm_dlc *d;
 270         struct sock *sk;
 271
 272         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 273         if (!sk)
 274                 return NULL;
 275
 276         sock_init_data(sock, sk);
 277         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 278
 279         d = rfcomm_dlc_alloc(prio);
 280         if (!d) {
 281                 sk_free(sk);
 282                 return NULL;
 283         }
 284
 285         d->data_ready   = rfcomm_sk_data_ready;
 286         d->state_change = rfcomm_sk_state_change;
 287
 288         rfcomm_pi(sk)->dlc = d;
 289         d->owner = sk;
 290
 291         sk->sk_destruct = rfcomm_sock_destruct;
 292         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 293
 294         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 295         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 296
 297         sock_reset_flag(sk, SOCK_ZAPPED);
 298
 299         sk->sk_protocol = proto;
 300         sk->sk_state    = BT_OPEN;
 301
 302         bt_sock_link(&rfcomm_sk_list, sk);
 303
 304         BT_DBG("sk %p", sk);
 305         return sk;
 306 }
 307
 308 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 309                               int protocol, int kern)
 310 {
 311         struct sock *sk;
 312
 313         BT_DBG("sock %p", sock);
 314
 315         sock->state = SS_UNCONNECTED;
 316
 317         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 318                 return -ESOCKTNOSUPPORT;
 319
 320         sock->ops = &rfcomm_sock_ops;
 321
 322         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 323         if (!sk)
 324                 return -ENOMEM;
 325
 326         rfcomm_sock_init(sk, NULL);
 327         return 0;
 328 }
 329
 330 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 331 {
 332         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 333         struct sock *sk = sock->sk;
 334         int err = 0;
 335
 336         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
 337
 338         if (!addr || addr->sa_family != AF_BLUETOOTH)
 339                 return -EINVAL;
 340
 341         lock_sock(sk);
 342
 343         if (sk->sk_state != BT_OPEN) {
 344                 err = -EBADFD;
 345                 goto done;
 346         }
 347
 348         if (sk->sk_type != SOCK_STREAM) {
 349                 err = -EINVAL;
 350                 goto done;
 351         }
 352
 353         write_lock(&rfcomm_sk_list.lock);
 354
 355         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 356                 err = -EADDRINUSE;
 357         } else {
 358                 /* Save source address */
 359                 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
 360                 rfcomm_pi(sk)->channel = sa->rc_channel;
 361                 sk->sk_state = BT_BOUND;
 362         }
 363
 364         write_unlock(&rfcomm_sk_list.lock);
 365
 366 done:
 367         release_sock(sk);
 368         return err;
 369 }
 370
 371 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 372 {
 373         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 374         struct sock *sk = sock->sk;
 375         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 376         int err = 0;
 377
 378         BT_DBG("sk %p", sk);
 379
 380         if (alen < sizeof(struct sockaddr_rc) ||
 381             addr->sa_family != AF_BLUETOOTH)
 382                 return -EINVAL;
 383
 384         lock_sock(sk);
 385
 386         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 387                 err = -EBADFD;
 388                 goto done;
 389         }
 390
 391         if (sk->sk_type != SOCK_STREAM) {
 392                 err = -EINVAL;
 393                 goto done;
 394         }
 395
 396         sk->sk_state = BT_CONNECT;
 397         bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
 398         rfcomm_pi(sk)->channel = sa->rc_channel;
 399
 400         d->sec_level = rfcomm_pi(sk)->sec_level;
 401         d->role_switch = rfcomm_pi(sk)->role_switch;
 402
 403         err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
 404                               sa->rc_channel);
 405         if (!err)
 406                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 407                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 408
 409 done:
 410         release_sock(sk);
 411         return err;
 412 }
 413
 414 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 415 {
 416         struct sock *sk = sock->sk;
 417         int err = 0;
 418
 419         BT_DBG("sk %p backlog %d", sk, backlog);
 420
 421         lock_sock(sk);
 422
 423         if (sk->sk_state != BT_BOUND) {
 424                 err = -EBADFD;
 425                 goto done;
 426         }
 427
 428         if (sk->sk_type != SOCK_STREAM) {
 429                 err = -EINVAL;
 430                 goto done;
 431         }
 432
 433         if (!rfcomm_pi(sk)->channel) {
 434                 bdaddr_t *src = &rfcomm_pi(sk)->src;
 435                 u8 channel;
 436
 437                 err = -EINVAL;
 438
 439                 write_lock(&rfcomm_sk_list.lock);
 440
 441                 for (channel = 1; channel < 31; channel++)
 442                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 443                                 rfcomm_pi(sk)->channel = channel;
 444                                 err = 0;
 445                                 break;
 446                         }
 447
 448                 write_unlock(&rfcomm_sk_list.lock);
 449
 450                 if (err < 0)
 451                         goto done;
 452         }
 453
 454         sk->sk_max_ack_backlog = backlog;
 455         sk->sk_ack_backlog = 0;
 456         sk->sk_state = BT_LISTEN;
 457
 458 done:
 459         release_sock(sk);
 460         return err;
 461 }
 462
 463 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 464 {
 465         DECLARE_WAITQUEUE(wait, current);
 466         struct sock *sk = sock->sk, *nsk;
 467         long timeo;
 468         int err = 0;
 469
 470         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 471
 472         if (sk->sk_type != SOCK_STREAM) {
 473                 err = -EINVAL;
 474                 goto done;
 475         }
 476
 477         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 478
 479         BT_DBG("sk %p timeo %ld", sk, timeo);
 480
 481         /* Wait for an incoming connection. (wake-one). */
 482         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 483         while (1) {
 484                 set_current_state(TASK_INTERRUPTIBLE);
 485
 486                 if (sk->sk_state != BT_LISTEN) {
 487                         err = -EBADFD;
 488                         break;
 489                 }
 490
 491                 nsk = bt_accept_dequeue(sk, newsock);
 492                 if (nsk)
 493                         break;
 494
 495                 if (!timeo) {
 496                         err = -EAGAIN;
 497                         break;
 498                 }
 499
 500                 if (signal_pending(current)) {
 501                         err = sock_intr_errno(timeo);
 502                         break;
 503                 }
 504
 505                 release_sock(sk);
 506                 timeo = schedule_timeout(timeo);
 507                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 508         }
 509         __set_current_state(TASK_RUNNING);
 510         remove_wait_queue(sk_sleep(sk), &wait);
 511
 512         if (err)
 513                 goto done;
 514
 515         newsock->state = SS_CONNECTED;
 516
 517         BT_DBG("new socket %p", nsk);
 518
 519 done:
 520         release_sock(sk);
 521         return err;
 522 }
 523
 524 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 525 {
 526         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 527         struct sock *sk = sock->sk;
 528
 529         BT_DBG("sock %p, sk %p", sock, sk);
 530
 531         memset(sa, 0, sizeof(*sa));
 532         sa->rc_family  = AF_BLUETOOTH;
 533         sa->rc_channel = rfcomm_pi(sk)->channel;
 534         if (peer)
 535                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
 536         else
 537                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 538
 539         *len = sizeof(struct sockaddr_rc);
 540         return 0;
 541 }
 542
 543 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 544                                struct msghdr *msg, size_t len)
 545 {
 546         struct sock *sk = sock->sk;
 547         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 548         struct sk_buff *skb;
 549         int sent;
 550
 551         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 552                 return -ENOTCONN;
 553
 554         if (msg->msg_flags & MSG_OOB)
 555                 return -EOPNOTSUPP;
 556
 557         if (sk->sk_shutdown & SEND_SHUTDOWN)
 558                 return -EPIPE;
 559
 560         BT_DBG("sock %p, sk %p", sock, sk);
 561
 562         lock_sock(sk);
 563
 564         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 565         if (sent)
 566                 goto done;
 567
 568         while (len) {
 569                 size_t size = min_t(size_t, len, d->mtu);
 570                 int err;
 571
 572                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 573                                 msg->msg_flags & MSG_DONTWAIT, &err);
 574                 if (!skb) {
 575                         if (sent == 0)
 576                                 sent = err;
 577                         break;
 578                 }
 579                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 580
 581                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 582                 if (err) {
 583                         kfree_skb(skb);
 584                         if (sent == 0)
 585                                 sent = err;
 586                         break;
 587                 }
 588
 589                 skb->priority = sk->sk_priority;
 590
 591                 err = rfcomm_dlc_send(d, skb);
 592                 if (err < 0) {
 593                         kfree_skb(skb);
 594                         if (sent == 0)
 595                                 sent = err;
 596                         break;
 597                 }
 598
 599                 sent += size;
 600                 len  -= size;
 601         }
 602
 603 done:
 604         release_sock(sk);
 605
 606         return sent;
 607 }
 608
 609 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 610                                struct msghdr *msg, size_t size, int flags)
 611 {
 612         struct sock *sk = sock->sk;
 613         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 614         int len;
 615
 616         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 617                 rfcomm_dlc_accept(d);
 618                 msg->msg_namelen = 0;
 619                 return 0;
 620         }
 621
 622         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 623
 624         lock_sock(sk);
 625         if (!(flags & MSG_PEEK) && len > 0)
 626                 atomic_sub(len, &sk->sk_rmem_alloc);
 627
 628         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 629                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 630         release_sock(sk);
 631
 632         return len;
 633 }
 634
 635 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 636 {
 637         struct sock *sk = sock->sk;
 638         int err = 0;
 639         u32 opt;
 640
 641         BT_DBG("sk %p", sk);
 642
 643         lock_sock(sk);
 644
 645         switch (optname) {
 646         case RFCOMM_LM:
 647                 if (get_user(opt, (u32 __user *) optval)) {
 648                         err = -EFAULT;
 649                         break;
 650                 }
 651
 652                 if (opt & RFCOMM_LM_AUTH)
 653                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 654                 if (opt & RFCOMM_LM_ENCRYPT)
 655                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 656                 if (opt & RFCOMM_LM_SECURE)
 657                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 658
 659                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 660                 break;
 661
 662         default:
 663                 err = -ENOPROTOOPT;
 664                 break;
 665         }
 666
 667         release_sock(sk);
 668         return err;
 669 }
 670
 671 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 672 {
 673         struct sock *sk = sock->sk;
 674         struct bt_security sec;
 675         int err = 0;
 676         size_t len;
 677         u32 opt;
 678
 679         BT_DBG("sk %p", sk);
 680
 681         if (level == SOL_RFCOMM)
 682                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 683
 684         if (level != SOL_BLUETOOTH)
 685                 return -ENOPROTOOPT;
 686
 687         lock_sock(sk);
 688
 689         switch (optname) {
 690         case BT_SECURITY:
 691                 if (sk->sk_type != SOCK_STREAM) {
 692                         err = -EINVAL;
 693                         break;
 694                 }
 695
 696                 sec.level = BT_SECURITY_LOW;
 697
 698                 len = min_t(unsigned int, sizeof(sec), optlen);
 699                 if (copy_from_user((char *) &sec, optval, len)) {
 700                         err = -EFAULT;
 701                         break;
 702                 }
 703
 704                 if (sec.level > BT_SECURITY_HIGH) {
 705                         err = -EINVAL;
 706                         break;
 707                 }
 708
 709                 rfcomm_pi(sk)->sec_level = sec.level;
 710                 break;
 711
 712         case BT_DEFER_SETUP:
 713                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 714                         err = -EINVAL;
 715                         break;
 716                 }
 717
 718                 if (get_user(opt, (u32 __user *) optval)) {
 719                         err = -EFAULT;
 720                         break;
 721                 }
 722
 723                 if (opt)
 724                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 725                 else
 726                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 727
 728                 break;
 729
 730         default:
 731                 err = -ENOPROTOOPT;
 732                 break;
 733         }
 734
 735         release_sock(sk);
 736         return err;
 737 }
 738
 739 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 740 {
 741         struct sock *sk = sock->sk;
 742         struct sock *l2cap_sk;
 743         struct l2cap_conn *conn;
 744         struct rfcomm_conninfo cinfo;
 745         int len, err = 0;
 746         u32 opt;
 747
 748         BT_DBG("sk %p", sk);
 749
 750         if (get_user(len, optlen))
 751                 return -EFAULT;
 752
 753         lock_sock(sk);
 754
 755         switch (optname) {
 756         case RFCOMM_LM:
 757                 switch (rfcomm_pi(sk)->sec_level) {
 758                 case BT_SECURITY_LOW:
 759                         opt = RFCOMM_LM_AUTH;
 760                         break;
 761                 case BT_SECURITY_MEDIUM:
 762                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 763                         break;
 764                 case BT_SECURITY_HIGH:
 765                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 766                                                         RFCOMM_LM_SECURE;
 767                         break;
 768                 default:
 769                         opt = 0;
 770                         break;
 771                 }
 772
 773                 if (rfcomm_pi(sk)->role_switch)
 774                         opt |= RFCOMM_LM_MASTER;
 775
 776                 if (put_user(opt, (u32 __user *) optval))
 777                         err = -EFAULT;
 778                 break;
 779
 780         case RFCOMM_CONNINFO:
 781                 if (sk->sk_state != BT_CONNECTED &&
 782                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 783                         err = -ENOTCONN;
 784                         break;
 785                 }
 786
 787                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 788                 conn = l2cap_pi(l2cap_sk)->chan->conn;
 789
 790                 memset(&cinfo, 0, sizeof(cinfo));
 791                 cinfo.hci_handle = conn->hcon->handle;
 792                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 793
 794                 len = min_t(unsigned int, len, sizeof(cinfo));
 795                 if (copy_to_user(optval, (char *) &cinfo, len))
 796                         err = -EFAULT;
 797
 798                 break;
 799
 800         default:
 801                 err = -ENOPROTOOPT;
 802                 break;
 803         }
 804
 805         release_sock(sk);
 806         return err;
 807 }
 808
 809 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 810 {
 811         struct sock *sk = sock->sk;
 812         struct bt_security sec;
 813         int len, err = 0;
 814
 815         BT_DBG("sk %p", sk);
 816
 817         if (level == SOL_RFCOMM)
 818                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 819
 820         if (level != SOL_BLUETOOTH)
 821                 return -ENOPROTOOPT;
 822
 823         if (get_user(len, optlen))
 824                 return -EFAULT;
 825
 826         lock_sock(sk);
 827
 828         switch (optname) {
 829         case BT_SECURITY:
 830                 if (sk->sk_type != SOCK_STREAM) {
 831                         err = -EINVAL;
 832                         break;
 833                 }
 834
 835                 sec.level = rfcomm_pi(sk)->sec_level;
 836                 sec.key_size = 0;
 837
 838                 len = min_t(unsigned int, len, sizeof(sec));
 839                 if (copy_to_user(optval, (char *) &sec, len))
 840                         err = -EFAULT;
 841
 842                 break;
 843
 844         case BT_DEFER_SETUP:
 845                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 846                         err = -EINVAL;
 847                         break;
 848                 }
 849
 850                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 851                              (u32 __user *) optval))
 852                         err = -EFAULT;
 853
 854                 break;
 855
 856         default:
 857                 err = -ENOPROTOOPT;
 858                 break;
 859         }
 860
 861         release_sock(sk);
 862         return err;
 863 }
 864
 865 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 866 {
 867         struct sock *sk __maybe_unused = sock->sk;
 868         int err;
 869
 870         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 871
 872         err = bt_sock_ioctl(sock, cmd, arg);
 873
 874         if (err == -ENOIOCTLCMD) {
 875 #ifdef CONFIG_BT_RFCOMM_TTY
 876                 lock_sock(sk);
 877                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 878                 release_sock(sk);
 879 #else
 880                 err = -EOPNOTSUPP;
 881 #endif
 882         }
 883
 884         return err;
 885 }
 886
 887 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 888 {
 889         struct sock *sk = sock->sk;
 890         int err = 0;
 891
 892         BT_DBG("sock %p, sk %p", sock, sk);
 893
 894         if (!sk)
 895                 return 0;
 896
 897         lock_sock(sk);
 898         if (!sk->sk_shutdown) {
 899                 sk->sk_shutdown = SHUTDOWN_MASK;
 900                 __rfcomm_sock_close(sk);
 901
 902                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 903                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 904         }
 905         release_sock(sk);
 906         return err;
 907 }
 908
 909 static int rfcomm_sock_release(struct socket *sock)
 910 {
 911         struct sock *sk = sock->sk;
 912         int err;
 913
 914         BT_DBG("sock %p, sk %p", sock, sk);
 915
 916         if (!sk)
 917                 return 0;
 918
 919         err = rfcomm_sock_shutdown(sock, 2);
 920
 921         sock_orphan(sk);
 922         rfcomm_sock_kill(sk);
 923         return err;
 924 }
 925
 926 /* ---- RFCOMM core layer callbacks ----
 927  *
 928  * called under rfcomm_lock()
 929  */
 930 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 931 {
 932         struct sock *sk, *parent;
 933         bdaddr_t src, dst;
 934         int result = 0;
 935
 936         BT_DBG("session %p channel %d", s, channel);
 937
 938         rfcomm_session_getaddr(s, &src, &dst);
 939
 940         /* Check if we have socket listening on channel */
 941         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 942         if (!parent)
 943                 return 0;
 944
 945         bh_lock_sock(parent);
 946
 947         /* Check for backlog size */
 948         if (sk_acceptq_is_full(parent)) {
 949                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 950                 goto done;
 951         }
 952
 953         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 954         if (!sk)
 955                 goto done;
 956
 957         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 958
 959         rfcomm_sock_init(sk, parent);
 960         bacpy(&rfcomm_pi(sk)->src, &src);
 961         bacpy(&rfcomm_pi(sk)->dst, &dst);
 962         rfcomm_pi(sk)->channel = channel;
 963
 964         sk->sk_state = BT_CONFIG;
 965         bt_accept_enqueue(parent, sk);
 966
 967         /* Accept connection and return socket DLC */
 968         *d = rfcomm_pi(sk)->dlc;
 969         result = 1;
 970
 971 done:
 972         bh_unlock_sock(parent);
 973
 974         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 975                 parent->sk_state_change(parent);
 976
 977         return result;
 978 }
 979
 980 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 981 {
 982         struct sock *sk;
 983
 984         read_lock(&rfcomm_sk_list.lock);
 985
 986         sk_for_each(sk, &rfcomm_sk_list.head) {
 987                 seq_printf(f, "%pMR %pMR %d %d\n",
 988                            &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
 989                            sk->sk_state, rfcomm_pi(sk)->channel);
 990         }
 991
 992         read_unlock(&rfcomm_sk_list.lock);
 993
 994         return 0;
 995 }
 996
 997 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
 998 {
 999         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1000 }
1001
1002 static const struct file_operations rfcomm_sock_debugfs_fops = {
1003         .open           = rfcomm_sock_debugfs_open,
1004         .read           = seq_read,
1005         .llseek         = seq_lseek,
1006         .release        = single_release,
1007 };
1008
1009 static struct dentry *rfcomm_sock_debugfs;
1010
1011 static const struct proto_ops rfcomm_sock_ops = {
1012         .family         = PF_BLUETOOTH,
1013         .owner          = THIS_MODULE,
1014         .release        = rfcomm_sock_release,
1015         .bind           = rfcomm_sock_bind,
1016         .connect        = rfcomm_sock_connect,
1017         .listen         = rfcomm_sock_listen,
1018         .accept         = rfcomm_sock_accept,
1019         .getname        = rfcomm_sock_getname,
1020         .sendmsg        = rfcomm_sock_sendmsg,
1021         .recvmsg        = rfcomm_sock_recvmsg,
1022         .shutdown       = rfcomm_sock_shutdown,
1023         .setsockopt     = rfcomm_sock_setsockopt,
1024         .getsockopt     = rfcomm_sock_getsockopt,
1025         .ioctl          = rfcomm_sock_ioctl,
1026         .poll           = bt_sock_poll,
1027         .socketpair     = sock_no_socketpair,
1028         .mmap           = sock_no_mmap
1029 };
1030
1031 static const struct net_proto_family rfcomm_sock_family_ops = {
1032         .family         = PF_BLUETOOTH,
1033         .owner          = THIS_MODULE,
1034         .create         = rfcomm_sock_create
1035 };
1036
1037 int __init rfcomm_init_sockets(void)
1038 {
1039         int err;
1040
1041         err = proto_register(&rfcomm_proto, 0);
1042         if (err < 0)
1043                 return err;
1044
1045         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1046         if (err < 0) {
1047                 BT_ERR("RFCOMM socket layer registration failed");
1048                 goto error;
1049         }
1050
1051         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1052         if (err < 0) {
1053                 BT_ERR("Failed to create RFCOMM proc file");
1054                 bt_sock_unregister(BTPROTO_RFCOMM);
1055                 goto error;
1056         }
1057
1058         BT_INFO("RFCOMM socket layer initialized");
1059
1060         if (IS_ERR_OR_NULL(bt_debugfs))
1061                 return 0;
1062
1063         rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1064                                                   bt_debugfs, NULL,
1065                                                   &rfcomm_sock_debugfs_fops);
1066
1067         return 0;
1068
1069 error:
1070         proto_unregister(&rfcomm_proto);
1071         return err;
1072 }
1073
1074 void __exit rfcomm_cleanup_sockets(void)
1075 {
1076         bt_procfs_cleanup(&init_net, "rfcomm");
1077
1078         debugfs_remove(rfcomm_sock_debugfs);
1079
1080         bt_sock_unregister(BTPROTO_RFCOMM);
1081
1082         proto_unregister(&rfcomm_proto);
1083 }