net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/rfcomm.h>
  35
  36 static const struct proto_ops rfcomm_sock_ops;
  37
  38 static struct bt_sock_list rfcomm_sk_list = {
  39         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  40 };
  41
  42 static void rfcomm_sock_close(struct sock *sk);
  43 static void rfcomm_sock_kill(struct sock *sk);
  44
  45 /* ---- DLC callbacks ----
  46  *
  47  * called under rfcomm_dlc_lock()
  48  */
  49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  50 {
  51         struct sock *sk = d->owner;
  52         if (!sk)
  53                 return;
  54
  55         atomic_add(skb->len, &sk->sk_rmem_alloc);
  56         skb_queue_tail(&sk->sk_receive_queue, skb);
  57         sk->sk_data_ready(sk, skb->len);
  58
  59         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  60                 rfcomm_dlc_throttle(d);
  61 }
  62
  63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  64 {
  65         struct sock *sk = d->owner, *parent;
  66         unsigned long flags;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         local_irq_save(flags);
  74         bh_lock_sock(sk);
  75
  76         if (err)
  77                 sk->sk_err = err;
  78
  79         sk->sk_state = d->state;
  80
  81         parent = bt_sk(sk)->parent;
  82         if (parent) {
  83                 if (d->state == BT_CLOSED) {
  84                         sock_set_flag(sk, SOCK_ZAPPED);
  85                         bt_accept_unlink(sk);
  86                 }
  87                 parent->sk_data_ready(parent, 0);
  88         } else {
  89                 if (d->state == BT_CONNECTED)
  90                         rfcomm_session_getaddr(d->session,
  91                                                &rfcomm_pi(sk)->src, NULL);
  92                 sk->sk_state_change(sk);
  93         }
  94
  95         bh_unlock_sock(sk);
  96         local_irq_restore(flags);
  97
  98         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  99                 /* We have to drop DLC lock here, otherwise
 100                  * rfcomm_sock_destruct() will dead lock. */
 101                 rfcomm_dlc_unlock(d);
 102                 rfcomm_sock_kill(sk);
 103                 rfcomm_dlc_lock(d);
 104         }
 105 }
 106
 107 /* ---- Socket functions ---- */
 108 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 109 {
 110         struct sock *sk = NULL;
 111
 112         sk_for_each(sk, &rfcomm_sk_list.head) {
 113                 if (rfcomm_pi(sk)->channel == channel &&
 114                                 !bacmp(&rfcomm_pi(sk)->src, src))
 115                         break;
 116         }
 117
 118         return sk ? sk : NULL;
 119 }
 120
 121 /* Find socket with channel and source bdaddr.
 122  * Returns closest match.
 123  */
 124 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 125 {
 126         struct sock *sk = NULL, *sk1 = NULL;
 127
 128         read_lock(&rfcomm_sk_list.lock);
 129
 130         sk_for_each(sk, &rfcomm_sk_list.head) {
 131                 if (state && sk->sk_state != state)
 132                         continue;
 133
 134                 if (rfcomm_pi(sk)->channel == channel) {
 135                         /* Exact match. */
 136                         if (!bacmp(&rfcomm_pi(sk)->src, src))
 137                                 break;
 138
 139                         /* Closest match */
 140                         if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
 141                                 sk1 = sk;
 142                 }
 143         }
 144
 145         read_unlock(&rfcomm_sk_list.lock);
 146
 147         return sk ? sk : sk1;
 148 }
 149
 150 static void rfcomm_sock_destruct(struct sock *sk)
 151 {
 152         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 153
 154         BT_DBG("sk %p dlc %p", sk, d);
 155
 156         skb_queue_purge(&sk->sk_receive_queue);
 157         skb_queue_purge(&sk->sk_write_queue);
 158
 159         rfcomm_dlc_lock(d);
 160         rfcomm_pi(sk)->dlc = NULL;
 161
 162         /* Detach DLC if it's owned by this socket */
 163         if (d->owner == sk)
 164                 d->owner = NULL;
 165         rfcomm_dlc_unlock(d);
 166
 167         rfcomm_dlc_put(d);
 168 }
 169
 170 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 171 {
 172         struct sock *sk;
 173
 174         BT_DBG("parent %p", parent);
 175
 176         /* Close not yet accepted dlcs */
 177         while ((sk = bt_accept_dequeue(parent, NULL))) {
 178                 rfcomm_sock_close(sk);
 179                 rfcomm_sock_kill(sk);
 180         }
 181
 182         parent->sk_state  = BT_CLOSED;
 183         sock_set_flag(parent, SOCK_ZAPPED);
 184 }
 185
 186 /* Kill socket (only if zapped and orphan)
 187  * Must be called on unlocked socket.
 188  */
 189 static void rfcomm_sock_kill(struct sock *sk)
 190 {
 191         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 192                 return;
 193
 194         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 195
 196         /* Kill poor orphan */
 197         bt_sock_unlink(&rfcomm_sk_list, sk);
 198         sock_set_flag(sk, SOCK_DEAD);
 199         sock_put(sk);
 200 }
 201
 202 static void __rfcomm_sock_close(struct sock *sk)
 203 {
 204         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 205
 206         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 207
 208         switch (sk->sk_state) {
 209         case BT_LISTEN:
 210                 rfcomm_sock_cleanup_listen(sk);
 211                 break;
 212
 213         case BT_CONNECT:
 214         case BT_CONNECT2:
 215         case BT_CONFIG:
 216         case BT_CONNECTED:
 217                 rfcomm_dlc_close(d, 0);
 218
 219         default:
 220                 sock_set_flag(sk, SOCK_ZAPPED);
 221                 break;
 222         }
 223 }
 224
 225 /* Close socket.
 226  * Must be called on unlocked socket.
 227  */
 228 static void rfcomm_sock_close(struct sock *sk)
 229 {
 230         lock_sock(sk);
 231         __rfcomm_sock_close(sk);
 232         release_sock(sk);
 233 }
 234
 235 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 236 {
 237         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 238
 239         BT_DBG("sk %p", sk);
 240
 241         if (parent) {
 242                 sk->sk_type = parent->sk_type;
 243                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 244                                                 &bt_sk(parent)->flags);
 245
 246                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 247                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 248
 249                 security_sk_clone(parent, sk);
 250         } else {
 251                 pi->dlc->defer_setup = 0;
 252
 253                 pi->sec_level = BT_SECURITY_LOW;
 254                 pi->role_switch = 0;
 255         }
 256
 257         pi->dlc->sec_level = pi->sec_level;
 258         pi->dlc->role_switch = pi->role_switch;
 259 }
 260
 261 static struct proto rfcomm_proto = {
 262         .name           = "RFCOMM",
 263         .owner          = THIS_MODULE,
 264         .obj_size       = sizeof(struct rfcomm_pinfo)
 265 };
 266
 267 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 268 {
 269         struct rfcomm_dlc *d;
 270         struct sock *sk;
 271
 272         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 273         if (!sk)
 274                 return NULL;
 275
 276         sock_init_data(sock, sk);
 277         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 278
 279         d = rfcomm_dlc_alloc(prio);
 280         if (!d) {
 281                 sk_free(sk);
 282                 return NULL;
 283         }
 284
 285         d->data_ready   = rfcomm_sk_data_ready;
 286         d->state_change = rfcomm_sk_state_change;
 287
 288         rfcomm_pi(sk)->dlc = d;
 289         d->owner = sk;
 290
 291         sk->sk_destruct = rfcomm_sock_destruct;
 292         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 293
 294         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 295         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 296
 297         sock_reset_flag(sk, SOCK_ZAPPED);
 298
 299         sk->sk_protocol = proto;
 300         sk->sk_state    = BT_OPEN;
 301
 302         bt_sock_link(&rfcomm_sk_list, sk);
 303
 304         BT_DBG("sk %p", sk);
 305         return sk;
 306 }
 307
 308 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 309                               int protocol, int kern)
 310 {
 311         struct sock *sk;
 312
 313         BT_DBG("sock %p", sock);
 314
 315         sock->state = SS_UNCONNECTED;
 316
 317         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 318                 return -ESOCKTNOSUPPORT;
 319
 320         sock->ops = &rfcomm_sock_ops;
 321
 322         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 323         if (!sk)
 324                 return -ENOMEM;
 325
 326         rfcomm_sock_init(sk, NULL);
 327         return 0;
 328 }
 329
 330 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 331 {
 332         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 333         struct sock *sk = sock->sk;
 334         int err = 0;
 335
 336         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
 337
 338         if (!addr || addr->sa_family != AF_BLUETOOTH)
 339                 return -EINVAL;
 340
 341         lock_sock(sk);
 342
 343         if (sk->sk_state != BT_OPEN) {
 344                 err = -EBADFD;
 345                 goto done;
 346         }
 347
 348         if (sk->sk_type != SOCK_STREAM) {
 349                 err = -EINVAL;
 350                 goto done;
 351         }
 352
 353         write_lock(&rfcomm_sk_list.lock);
 354
 355         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 356                 err = -EADDRINUSE;
 357         } else {
 358                 /* Save source address */
 359                 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
 360                 rfcomm_pi(sk)->channel = sa->rc_channel;
 361                 sk->sk_state = BT_BOUND;
 362         }
 363
 364         write_unlock(&rfcomm_sk_list.lock);
 365
 366 done:
 367         release_sock(sk);
 368         return err;
 369 }
 370
 371 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 372 {
 373         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 374         struct sock *sk = sock->sk;
 375         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 376         int err = 0;
 377
 378         BT_DBG("sk %p", sk);
 379
 380         if (alen < sizeof(struct sockaddr_rc) ||
 381             addr->sa_family != AF_BLUETOOTH)
 382                 return -EINVAL;
 383
 384         lock_sock(sk);
 385
 386         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 387                 err = -EBADFD;
 388                 goto done;
 389         }
 390
 391         if (sk->sk_type != SOCK_STREAM) {
 392                 err = -EINVAL;
 393                 goto done;
 394         }
 395
 396         sk->sk_state = BT_CONNECT;
 397         bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
 398         rfcomm_pi(sk)->channel = sa->rc_channel;
 399
 400         d->sec_level = rfcomm_pi(sk)->sec_level;
 401         d->role_switch = rfcomm_pi(sk)->role_switch;
 402
 403         err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
 404                               sa->rc_channel);
 405         if (!err)
 406                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 407                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 408
 409 done:
 410         release_sock(sk);
 411         return err;
 412 }
 413
 414 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 415 {
 416         struct sock *sk = sock->sk;
 417         int err = 0;
 418
 419         BT_DBG("sk %p backlog %d", sk, backlog);
 420
 421         lock_sock(sk);
 422
 423         if (sk->sk_state != BT_BOUND) {
 424                 err = -EBADFD;
 425                 goto done;
 426         }
 427
 428         if (sk->sk_type != SOCK_STREAM) {
 429                 err = -EINVAL;
 430                 goto done;
 431         }
 432
 433         if (!rfcomm_pi(sk)->channel) {
 434                 bdaddr_t *src = &rfcomm_pi(sk)->src;
 435                 u8 channel;
 436
 437                 err = -EINVAL;
 438
 439                 write_lock(&rfcomm_sk_list.lock);
 440
 441                 for (channel = 1; channel < 31; channel++)
 442                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 443                                 rfcomm_pi(sk)->channel = channel;
 444                                 err = 0;
 445                                 break;
 446                         }
 447
 448                 write_unlock(&rfcomm_sk_list.lock);
 449
 450                 if (err < 0)
 451                         goto done;
 452         }
 453
 454         sk->sk_max_ack_backlog = backlog;
 455         sk->sk_ack_backlog = 0;
 456         sk->sk_state = BT_LISTEN;
 457
 458 done:
 459         release_sock(sk);
 460         return err;
 461 }
 462
 463 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 464 {
 465         DECLARE_WAITQUEUE(wait, current);
 466         struct sock *sk = sock->sk, *nsk;
 467         long timeo;
 468         int err = 0;
 469
 470         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 471
 472         if (sk->sk_type != SOCK_STREAM) {
 473                 err = -EINVAL;
 474                 goto done;
 475         }
 476
 477         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 478
 479         BT_DBG("sk %p timeo %ld", sk, timeo);
 480
 481         /* Wait for an incoming connection. (wake-one). */
 482         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 483         while (1) {
 484                 set_current_state(TASK_INTERRUPTIBLE);
 485
 486                 if (sk->sk_state != BT_LISTEN) {
 487                         err = -EBADFD;
 488                         break;
 489                 }
 490
 491                 nsk = bt_accept_dequeue(sk, newsock);
 492                 if (nsk)
 493                         break;
 494
 495                 if (!timeo) {
 496                         err = -EAGAIN;
 497                         break;
 498                 }
 499
 500                 if (signal_pending(current)) {
 501                         err = sock_intr_errno(timeo);
 502                         break;
 503                 }
 504
 505                 release_sock(sk);
 506                 timeo = schedule_timeout(timeo);
 507                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 508         }
 509         __set_current_state(TASK_RUNNING);
 510         remove_wait_queue(sk_sleep(sk), &wait);
 511
 512         if (err)
 513                 goto done;
 514
 515         newsock->state = SS_CONNECTED;
 516
 517         BT_DBG("new socket %p", nsk);
 518
 519 done:
 520         release_sock(sk);
 521         return err;
 522 }
 523
 524 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 525 {
 526         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 527         struct sock *sk = sock->sk;
 528
 529         BT_DBG("sock %p, sk %p", sock, sk);
 530
 531         memset(sa, 0, sizeof(*sa));
 532         sa->rc_family  = AF_BLUETOOTH;
 533         sa->rc_channel = rfcomm_pi(sk)->channel;
 534         if (peer)
 535                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
 536         else
 537                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 538
 539         *len = sizeof(struct sockaddr_rc);
 540         return 0;
 541 }
 542
 543 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 544                                struct msghdr *msg, size_t len)
 545 {
 546         struct sock *sk = sock->sk;
 547         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 548         struct sk_buff *skb;
 549         int sent;
 550
 551         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 552                 return -ENOTCONN;
 553
 554         if (msg->msg_flags & MSG_OOB)
 555                 return -EOPNOTSUPP;
 556
 557         if (sk->sk_shutdown & SEND_SHUTDOWN)
 558                 return -EPIPE;
 559
 560         BT_DBG("sock %p, sk %p", sock, sk);
 561
 562         lock_sock(sk);
 563
 564         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 565         if (sent)
 566                 goto done;
 567
 568         while (len) {
 569                 size_t size = min_t(size_t, len, d->mtu);
 570                 int err;
 571
 572                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 573                                 msg->msg_flags & MSG_DONTWAIT, &err);
 574                 if (!skb) {
 575                         if (sent == 0)
 576                                 sent = err;
 577                         break;
 578                 }
 579                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 580
 581                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 582                 if (err) {
 583                         kfree_skb(skb);
 584                         if (sent == 0)
 585                                 sent = err;
 586                         break;
 587                 }
 588
 589                 skb->priority = sk->sk_priority;
 590
 591                 err = rfcomm_dlc_send(d, skb);
 592                 if (err < 0) {
 593                         kfree_skb(skb);
 594                         if (sent == 0)
 595                                 sent = err;
 596                         break;
 597                 }
 598
 599                 sent += size;
 600                 len  -= size;
 601         }
 602
 603 done:
 604         release_sock(sk);
 605
 606         return sent;
 607 }
 608
 609 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 610                                struct msghdr *msg, size_t size, int flags)
 611 {
 612         struct sock *sk = sock->sk;
 613         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 614         int len;
 615
 616         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 617                 rfcomm_dlc_accept(d);
 618                 msg->msg_namelen = 0;
 619                 return 0;
 620         }
 621
 622         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 623
 624         lock_sock(sk);
 625         if (!(flags & MSG_PEEK) && len > 0)
 626                 atomic_sub(len, &sk->sk_rmem_alloc);
 627
 628         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 629                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 630         release_sock(sk);
 631
 632         return len;
 633 }
 634
 635 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 636 {
 637         struct sock *sk = sock->sk;
 638         int err = 0;
 639         u32 opt;
 640
 641         BT_DBG("sk %p", sk);
 642
 643         lock_sock(sk);
 644
 645         switch (optname) {
 646         case RFCOMM_LM:
 647                 if (get_user(opt, (u32 __user *) optval)) {
 648                         err = -EFAULT;
 649                         break;
 650                 }
 651
 652                 if (opt & RFCOMM_LM_AUTH)
 653                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 654                 if (opt & RFCOMM_LM_ENCRYPT)
 655                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 656                 if (opt & RFCOMM_LM_SECURE)
 657                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 658
 659                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 660                 break;
 661
 662         default:
 663                 err = -ENOPROTOOPT;
 664                 break;
 665         }
 666
 667         release_sock(sk);
 668         return err;
 669 }
 670
 671 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 672 {
 673         struct sock *sk = sock->sk;
 674         struct bt_security sec;
 675         int err = 0;
 676         size_t len;
 677         u32 opt;
 678
 679         BT_DBG("sk %p", sk);
 680
 681         if (level == SOL_RFCOMM)
 682                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 683
 684         if (level != SOL_BLUETOOTH)
 685                 return -ENOPROTOOPT;
 686
 687         lock_sock(sk);
 688
 689         switch (optname) {
 690         case BT_SECURITY:
 691                 if (sk->sk_type != SOCK_STREAM) {
 692                         err = -EINVAL;
 693                         break;
 694                 }
 695
 696                 sec.level = BT_SECURITY_LOW;
 697
 698                 len = min_t(unsigned int, sizeof(sec), optlen);
 699                 if (copy_from_user((char *) &sec, optval, len)) {
 700                         err = -EFAULT;
 701                         break;
 702                 }
 703
 704                 if (sec.level > BT_SECURITY_HIGH) {
 705                         err = -EINVAL;
 706                         break;
 707                 }
 708
 709                 rfcomm_pi(sk)->sec_level = sec.level;
 710                 break;
 711
 712         case BT_DEFER_SETUP:
 713                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 714                         err = -EINVAL;
 715                         break;
 716                 }
 717
 718                 if (get_user(opt, (u32 __user *) optval)) {
 719                         err = -EFAULT;
 720                         break;
 721                 }
 722
 723                 if (opt)
 724                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 725                 else
 726                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 727
 728                 break;
 729
 730         default:
 731                 err = -ENOPROTOOPT;
 732                 break;
 733         }
 734
 735         release_sock(sk);
 736         return err;
 737 }
 738
 739 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 740 {
 741         struct sock *sk = sock->sk;
 742         struct rfcomm_conninfo cinfo;
 743         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 744         int len, err = 0;
 745         u32 opt;
 746
 747         BT_DBG("sk %p", sk);
 748
 749         if (get_user(len, optlen))
 750                 return -EFAULT;
 751
 752         lock_sock(sk);
 753
 754         switch (optname) {
 755         case RFCOMM_LM:
 756                 switch (rfcomm_pi(sk)->sec_level) {
 757                 case BT_SECURITY_LOW:
 758                         opt = RFCOMM_LM_AUTH;
 759                         break;
 760                 case BT_SECURITY_MEDIUM:
 761                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 762                         break;
 763                 case BT_SECURITY_HIGH:
 764                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 765                                                         RFCOMM_LM_SECURE;
 766                         break;
 767                 default:
 768                         opt = 0;
 769                         break;
 770                 }
 771
 772                 if (rfcomm_pi(sk)->role_switch)
 773                         opt |= RFCOMM_LM_MASTER;
 774
 775                 if (put_user(opt, (u32 __user *) optval))
 776                         err = -EFAULT;
 777                 break;
 778
 779         case RFCOMM_CONNINFO:
 780                 if (sk->sk_state != BT_CONNECTED &&
 781                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 782                         err = -ENOTCONN;
 783                         break;
 784                 }
 785
 786                 memset(&cinfo, 0, sizeof(cinfo));
 787                 cinfo.hci_handle = conn->hcon->handle;
 788                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 789
 790                 len = min_t(unsigned int, len, sizeof(cinfo));
 791                 if (copy_to_user(optval, (char *) &cinfo, len))
 792                         err = -EFAULT;
 793
 794                 break;
 795
 796         default:
 797                 err = -ENOPROTOOPT;
 798                 break;
 799         }
 800
 801         release_sock(sk);
 802         return err;
 803 }
 804
 805 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 806 {
 807         struct sock *sk = sock->sk;
 808         struct bt_security sec;
 809         int len, err = 0;
 810
 811         BT_DBG("sk %p", sk);
 812
 813         if (level == SOL_RFCOMM)
 814                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 815
 816         if (level != SOL_BLUETOOTH)
 817                 return -ENOPROTOOPT;
 818
 819         if (get_user(len, optlen))
 820                 return -EFAULT;
 821
 822         lock_sock(sk);
 823
 824         switch (optname) {
 825         case BT_SECURITY:
 826                 if (sk->sk_type != SOCK_STREAM) {
 827                         err = -EINVAL;
 828                         break;
 829                 }
 830
 831                 sec.level = rfcomm_pi(sk)->sec_level;
 832                 sec.key_size = 0;
 833
 834                 len = min_t(unsigned int, len, sizeof(sec));
 835                 if (copy_to_user(optval, (char *) &sec, len))
 836                         err = -EFAULT;
 837
 838                 break;
 839
 840         case BT_DEFER_SETUP:
 841                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 842                         err = -EINVAL;
 843                         break;
 844                 }
 845
 846                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 847                              (u32 __user *) optval))
 848                         err = -EFAULT;
 849
 850                 break;
 851
 852         default:
 853                 err = -ENOPROTOOPT;
 854                 break;
 855         }
 856
 857         release_sock(sk);
 858         return err;
 859 }
 860
 861 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 862 {
 863         struct sock *sk __maybe_unused = sock->sk;
 864         int err;
 865
 866         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 867
 868         err = bt_sock_ioctl(sock, cmd, arg);
 869
 870         if (err == -ENOIOCTLCMD) {
 871 #ifdef CONFIG_BT_RFCOMM_TTY
 872                 lock_sock(sk);
 873                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 874                 release_sock(sk);
 875 #else
 876                 err = -EOPNOTSUPP;
 877 #endif
 878         }
 879
 880         return err;
 881 }
 882
 883 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 884 {
 885         struct sock *sk = sock->sk;
 886         int err = 0;
 887
 888         BT_DBG("sock %p, sk %p", sock, sk);
 889
 890         if (!sk)
 891                 return 0;
 892
 893         lock_sock(sk);
 894         if (!sk->sk_shutdown) {
 895                 sk->sk_shutdown = SHUTDOWN_MASK;
 896                 __rfcomm_sock_close(sk);
 897
 898                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 899                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 900         }
 901         release_sock(sk);
 902         return err;
 903 }
 904
 905 static int rfcomm_sock_release(struct socket *sock)
 906 {
 907         struct sock *sk = sock->sk;
 908         int err;
 909
 910         BT_DBG("sock %p, sk %p", sock, sk);
 911
 912         if (!sk)
 913                 return 0;
 914
 915         err = rfcomm_sock_shutdown(sock, 2);
 916
 917         sock_orphan(sk);
 918         rfcomm_sock_kill(sk);
 919         return err;
 920 }
 921
 922 /* ---- RFCOMM core layer callbacks ----
 923  *
 924  * called under rfcomm_lock()
 925  */
 926 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 927 {
 928         struct sock *sk, *parent;
 929         bdaddr_t src, dst;
 930         int result = 0;
 931
 932         BT_DBG("session %p channel %d", s, channel);
 933
 934         rfcomm_session_getaddr(s, &src, &dst);
 935
 936         /* Check if we have socket listening on channel */
 937         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 938         if (!parent)
 939                 return 0;
 940
 941         bh_lock_sock(parent);
 942
 943         /* Check for backlog size */
 944         if (sk_acceptq_is_full(parent)) {
 945                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 946                 goto done;
 947         }
 948
 949         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 950         if (!sk)
 951                 goto done;
 952
 953         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 954
 955         rfcomm_sock_init(sk, parent);
 956         bacpy(&rfcomm_pi(sk)->src, &src);
 957         bacpy(&rfcomm_pi(sk)->dst, &dst);
 958         rfcomm_pi(sk)->channel = channel;
 959
 960         sk->sk_state = BT_CONFIG;
 961         bt_accept_enqueue(parent, sk);
 962
 963         /* Accept connection and return socket DLC */
 964         *d = rfcomm_pi(sk)->dlc;
 965         result = 1;
 966
 967 done:
 968         bh_unlock_sock(parent);
 969
 970         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 971                 parent->sk_state_change(parent);
 972
 973         return result;
 974 }
 975
 976 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 977 {
 978         struct sock *sk;
 979
 980         read_lock(&rfcomm_sk_list.lock);
 981
 982         sk_for_each(sk, &rfcomm_sk_list.head) {
 983                 seq_printf(f, "%pMR %pMR %d %d\n",
 984                            &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
 985                            sk->sk_state, rfcomm_pi(sk)->channel);
 986         }
 987
 988         read_unlock(&rfcomm_sk_list.lock);
 989
 990         return 0;
 991 }
 992
 993 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
 994 {
 995         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
 996 }
 997
 998 static const struct file_operations rfcomm_sock_debugfs_fops = {
 999         .open           = rfcomm_sock_debugfs_open,
1000         .read           = seq_read,
1001         .llseek         = seq_lseek,
1002         .release        = single_release,
1003 };
1004
1005 static struct dentry *rfcomm_sock_debugfs;
1006
1007 static const struct proto_ops rfcomm_sock_ops = {
1008         .family         = PF_BLUETOOTH,
1009         .owner          = THIS_MODULE,
1010         .release        = rfcomm_sock_release,
1011         .bind           = rfcomm_sock_bind,
1012         .connect        = rfcomm_sock_connect,
1013         .listen         = rfcomm_sock_listen,
1014         .accept         = rfcomm_sock_accept,
1015         .getname        = rfcomm_sock_getname,
1016         .sendmsg        = rfcomm_sock_sendmsg,
1017         .recvmsg        = rfcomm_sock_recvmsg,
1018         .shutdown       = rfcomm_sock_shutdown,
1019         .setsockopt     = rfcomm_sock_setsockopt,
1020         .getsockopt     = rfcomm_sock_getsockopt,
1021         .ioctl          = rfcomm_sock_ioctl,
1022         .poll           = bt_sock_poll,
1023         .socketpair     = sock_no_socketpair,
1024         .mmap           = sock_no_mmap
1025 };
1026
1027 static const struct net_proto_family rfcomm_sock_family_ops = {
1028         .family         = PF_BLUETOOTH,
1029         .owner          = THIS_MODULE,
1030         .create         = rfcomm_sock_create
1031 };
1032
1033 int __init rfcomm_init_sockets(void)
1034 {
1035         int err;
1036
1037         err = proto_register(&rfcomm_proto, 0);
1038         if (err < 0)
1039                 return err;
1040
1041         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1042         if (err < 0) {
1043                 BT_ERR("RFCOMM socket layer registration failed");
1044                 goto error;
1045         }
1046
1047         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1048         if (err < 0) {
1049                 BT_ERR("Failed to create RFCOMM proc file");
1050                 bt_sock_unregister(BTPROTO_RFCOMM);
1051                 goto error;
1052         }
1053
1054         if (bt_debugfs) {
1055                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1056                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1057                 if (!rfcomm_sock_debugfs)
1058                         BT_ERR("Failed to create RFCOMM debug file");
1059         }
1060
1061         BT_INFO("RFCOMM socket layer initialized");
1062
1063         return 0;
1064
1065 error:
1066         proto_unregister(&rfcomm_proto);
1067         return err;
1068 }
1069
1070 void __exit rfcomm_cleanup_sockets(void)
1071 {
1072         bt_procfs_cleanup(&init_net, "rfcomm");
1073
1074         debugfs_remove(rfcomm_sock_debugfs);
1075
1076         bt_sock_unregister(BTPROTO_RFCOMM);
1077
1078         proto_unregister(&rfcomm_proto);
1079 }