net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/rfcomm.h>
  35
  36 static const struct proto_ops rfcomm_sock_ops;
  37
  38 static struct bt_sock_list rfcomm_sk_list = {
  39         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  40 };
  41
  42 static void rfcomm_sock_close(struct sock *sk);
  43 static void rfcomm_sock_kill(struct sock *sk);
  44
  45 /* ---- DLC callbacks ----
  46  *
  47  * called under rfcomm_dlc_lock()
  48  */
  49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  50 {
  51         struct sock *sk = d->owner;
  52         if (!sk)
  53                 return;
  54
  55         atomic_add(skb->len, &sk->sk_rmem_alloc);
  56         skb_queue_tail(&sk->sk_receive_queue, skb);
  57         sk->sk_data_ready(sk, skb->len);
  58
  59         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  60                 rfcomm_dlc_throttle(d);
  61 }
  62
  63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  64 {
  65         struct sock *sk = d->owner, *parent;
  66         unsigned long flags;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         local_irq_save(flags);
  74         bh_lock_sock(sk);
  75
  76         if (err)
  77                 sk->sk_err = err;
  78
  79         sk->sk_state = d->state;
  80
  81         parent = bt_sk(sk)->parent;
  82         if (parent) {
  83                 if (d->state == BT_CLOSED) {
  84                         sock_set_flag(sk, SOCK_ZAPPED);
  85                         bt_accept_unlink(sk);
  86                 }
  87                 parent->sk_data_ready(parent, 0);
  88         } else {
  89                 if (d->state == BT_CONNECTED)
  90                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
  91                 sk->sk_state_change(sk);
  92         }
  93
  94         bh_unlock_sock(sk);
  95         local_irq_restore(flags);
  96
  97         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  98                 /* We have to drop DLC lock here, otherwise
  99                  * rfcomm_sock_destruct() will dead lock. */
 100                 rfcomm_dlc_unlock(d);
 101                 rfcomm_sock_kill(sk);
 102                 rfcomm_dlc_lock(d);
 103         }
 104 }
 105
 106 /* ---- Socket functions ---- */
 107 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 108 {
 109         struct sock *sk = NULL;
 110         struct hlist_node *node;
 111
 112         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 113                 if (rfcomm_pi(sk)->channel == channel &&
 114                                 !bacmp(&bt_sk(sk)->src, src))
 115                         break;
 116         }
 117
 118         return node ? sk : NULL;
 119 }
 120
 121 /* Find socket with channel and source bdaddr.
 122  * Returns closest match.
 123  */
 124 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 125 {
 126         struct sock *sk = NULL, *sk1 = NULL;
 127         struct hlist_node *node;
 128
 129         read_lock(&rfcomm_sk_list.lock);
 130
 131         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 132                 if (state && sk->sk_state != state)
 133                         continue;
 134
 135                 if (rfcomm_pi(sk)->channel == channel) {
 136                         /* Exact match. */
 137                         if (!bacmp(&bt_sk(sk)->src, src))
 138                                 break;
 139
 140                         /* Closest match */
 141                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 142                                 sk1 = sk;
 143                 }
 144         }
 145
 146         read_unlock(&rfcomm_sk_list.lock);
 147
 148         return node ? sk : sk1;
 149 }
 150
 151 static void rfcomm_sock_destruct(struct sock *sk)
 152 {
 153         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 154
 155         BT_DBG("sk %p dlc %p", sk, d);
 156
 157         skb_queue_purge(&sk->sk_receive_queue);
 158         skb_queue_purge(&sk->sk_write_queue);
 159
 160         rfcomm_dlc_lock(d);
 161         rfcomm_pi(sk)->dlc = NULL;
 162
 163         /* Detach DLC if it's owned by this socket */
 164         if (d->owner == sk)
 165                 d->owner = NULL;
 166         rfcomm_dlc_unlock(d);
 167
 168         rfcomm_dlc_put(d);
 169 }
 170
 171 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 172 {
 173         struct sock *sk;
 174
 175         BT_DBG("parent %p", parent);
 176
 177         /* Close not yet accepted dlcs */
 178         while ((sk = bt_accept_dequeue(parent, NULL))) {
 179                 rfcomm_sock_close(sk);
 180                 rfcomm_sock_kill(sk);
 181         }
 182
 183         parent->sk_state  = BT_CLOSED;
 184         sock_set_flag(parent, SOCK_ZAPPED);
 185 }
 186
 187 /* Kill socket (only if zapped and orphan)
 188  * Must be called on unlocked socket.
 189  */
 190 static void rfcomm_sock_kill(struct sock *sk)
 191 {
 192         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 193                 return;
 194
 195         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 196
 197         /* Kill poor orphan */
 198         bt_sock_unlink(&rfcomm_sk_list, sk);
 199         sock_set_flag(sk, SOCK_DEAD);
 200         sock_put(sk);
 201 }
 202
 203 static void __rfcomm_sock_close(struct sock *sk)
 204 {
 205         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 206
 207         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 208
 209         switch (sk->sk_state) {
 210         case BT_LISTEN:
 211                 rfcomm_sock_cleanup_listen(sk);
 212                 break;
 213
 214         case BT_CONNECT:
 215         case BT_CONNECT2:
 216         case BT_CONFIG:
 217         case BT_CONNECTED:
 218                 rfcomm_dlc_close(d, 0);
 219
 220         default:
 221                 sock_set_flag(sk, SOCK_ZAPPED);
 222                 break;
 223         }
 224 }
 225
 226 /* Close socket.
 227  * Must be called on unlocked socket.
 228  */
 229 static void rfcomm_sock_close(struct sock *sk)
 230 {
 231         lock_sock(sk);
 232         __rfcomm_sock_close(sk);
 233         release_sock(sk);
 234 }
 235
 236 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 237 {
 238         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 239
 240         BT_DBG("sk %p", sk);
 241
 242         if (parent) {
 243                 sk->sk_type = parent->sk_type;
 244                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 245                                                 &bt_sk(parent)->flags);
 246
 247                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 248                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 249
 250                 security_sk_clone(parent, sk);
 251         } else {
 252                 pi->dlc->defer_setup = 0;
 253
 254                 pi->sec_level = BT_SECURITY_LOW;
 255                 pi->role_switch = 0;
 256         }
 257
 258         pi->dlc->sec_level = pi->sec_level;
 259         pi->dlc->role_switch = pi->role_switch;
 260 }
 261
 262 static struct proto rfcomm_proto = {
 263         .name           = "RFCOMM",
 264         .owner          = THIS_MODULE,
 265         .obj_size       = sizeof(struct rfcomm_pinfo)
 266 };
 267
 268 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 269 {
 270         struct rfcomm_dlc *d;
 271         struct sock *sk;
 272
 273         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 274         if (!sk)
 275                 return NULL;
 276
 277         sock_init_data(sock, sk);
 278         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 279
 280         d = rfcomm_dlc_alloc(prio);
 281         if (!d) {
 282                 sk_free(sk);
 283                 return NULL;
 284         }
 285
 286         d->data_ready   = rfcomm_sk_data_ready;
 287         d->state_change = rfcomm_sk_state_change;
 288
 289         rfcomm_pi(sk)->dlc = d;
 290         d->owner = sk;
 291
 292         sk->sk_destruct = rfcomm_sock_destruct;
 293         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 294
 295         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 296         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 297
 298         sock_reset_flag(sk, SOCK_ZAPPED);
 299
 300         sk->sk_protocol = proto;
 301         sk->sk_state    = BT_OPEN;
 302
 303         bt_sock_link(&rfcomm_sk_list, sk);
 304
 305         BT_DBG("sk %p", sk);
 306         return sk;
 307 }
 308
 309 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 310                               int protocol, int kern)
 311 {
 312         struct sock *sk;
 313
 314         BT_DBG("sock %p", sock);
 315
 316         sock->state = SS_UNCONNECTED;
 317
 318         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 319                 return -ESOCKTNOSUPPORT;
 320
 321         sock->ops = &rfcomm_sock_ops;
 322
 323         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 324         if (!sk)
 325                 return -ENOMEM;
 326
 327         rfcomm_sock_init(sk, NULL);
 328         return 0;
 329 }
 330
 331 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 332 {
 333         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 334         struct sock *sk = sock->sk;
 335         int err = 0;
 336
 337         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
 338
 339         if (!addr || addr->sa_family != AF_BLUETOOTH)
 340                 return -EINVAL;
 341
 342         lock_sock(sk);
 343
 344         if (sk->sk_state != BT_OPEN) {
 345                 err = -EBADFD;
 346                 goto done;
 347         }
 348
 349         if (sk->sk_type != SOCK_STREAM) {
 350                 err = -EINVAL;
 351                 goto done;
 352         }
 353
 354         write_lock(&rfcomm_sk_list.lock);
 355
 356         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 357                 err = -EADDRINUSE;
 358         } else {
 359                 /* Save source address */
 360                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 361                 rfcomm_pi(sk)->channel = sa->rc_channel;
 362                 sk->sk_state = BT_BOUND;
 363         }
 364
 365         write_unlock(&rfcomm_sk_list.lock);
 366
 367 done:
 368         release_sock(sk);
 369         return err;
 370 }
 371
 372 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 373 {
 374         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 375         struct sock *sk = sock->sk;
 376         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 377         int err = 0;
 378
 379         BT_DBG("sk %p", sk);
 380
 381         if (alen < sizeof(struct sockaddr_rc) ||
 382             addr->sa_family != AF_BLUETOOTH)
 383                 return -EINVAL;
 384
 385         lock_sock(sk);
 386
 387         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 388                 err = -EBADFD;
 389                 goto done;
 390         }
 391
 392         if (sk->sk_type != SOCK_STREAM) {
 393                 err = -EINVAL;
 394                 goto done;
 395         }
 396
 397         sk->sk_state = BT_CONNECT;
 398         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 399         rfcomm_pi(sk)->channel = sa->rc_channel;
 400
 401         d->sec_level = rfcomm_pi(sk)->sec_level;
 402         d->role_switch = rfcomm_pi(sk)->role_switch;
 403
 404         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 405         if (!err)
 406                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 407                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 408
 409 done:
 410         release_sock(sk);
 411         return err;
 412 }
 413
 414 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 415 {
 416         struct sock *sk = sock->sk;
 417         int err = 0;
 418
 419         BT_DBG("sk %p backlog %d", sk, backlog);
 420
 421         lock_sock(sk);
 422
 423         if (sk->sk_state != BT_BOUND) {
 424                 err = -EBADFD;
 425                 goto done;
 426         }
 427
 428         if (sk->sk_type != SOCK_STREAM) {
 429                 err = -EINVAL;
 430                 goto done;
 431         }
 432
 433         if (!rfcomm_pi(sk)->channel) {
 434                 bdaddr_t *src = &bt_sk(sk)->src;
 435                 u8 channel;
 436
 437                 err = -EINVAL;
 438
 439                 write_lock(&rfcomm_sk_list.lock);
 440
 441                 for (channel = 1; channel < 31; channel++)
 442                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 443                                 rfcomm_pi(sk)->channel = channel;
 444                                 err = 0;
 445                                 break;
 446                         }
 447
 448                 write_unlock(&rfcomm_sk_list.lock);
 449
 450                 if (err < 0)
 451                         goto done;
 452         }
 453
 454         sk->sk_max_ack_backlog = backlog;
 455         sk->sk_ack_backlog = 0;
 456         sk->sk_state = BT_LISTEN;
 457
 458 done:
 459         release_sock(sk);
 460         return err;
 461 }
 462
 463 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 464 {
 465         DECLARE_WAITQUEUE(wait, current);
 466         struct sock *sk = sock->sk, *nsk;
 467         long timeo;
 468         int err = 0;
 469
 470         lock_sock(sk);
 471
 472         if (sk->sk_type != SOCK_STREAM) {
 473                 err = -EINVAL;
 474                 goto done;
 475         }
 476
 477         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 478
 479         BT_DBG("sk %p timeo %ld", sk, timeo);
 480
 481         /* Wait for an incoming connection. (wake-one). */
 482         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 483         while (1) {
 484                 set_current_state(TASK_INTERRUPTIBLE);
 485
 486                 if (sk->sk_state != BT_LISTEN) {
 487                         err = -EBADFD;
 488                         break;
 489                 }
 490
 491                 nsk = bt_accept_dequeue(sk, newsock);
 492                 if (nsk)
 493                         break;
 494
 495                 if (!timeo) {
 496                         err = -EAGAIN;
 497                         break;
 498                 }
 499
 500                 if (signal_pending(current)) {
 501                         err = sock_intr_errno(timeo);
 502                         break;
 503                 }
 504
 505                 release_sock(sk);
 506                 timeo = schedule_timeout(timeo);
 507                 lock_sock(sk);
 508         }
 509         __set_current_state(TASK_RUNNING);
 510         remove_wait_queue(sk_sleep(sk), &wait);
 511
 512         if (err)
 513                 goto done;
 514
 515         newsock->state = SS_CONNECTED;
 516
 517         BT_DBG("new socket %p", nsk);
 518
 519 done:
 520         release_sock(sk);
 521         return err;
 522 }
 523
 524 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 525 {
 526         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 527         struct sock *sk = sock->sk;
 528
 529         BT_DBG("sock %p, sk %p", sock, sk);
 530
 531         memset(sa, 0, sizeof(*sa));
 532         sa->rc_family  = AF_BLUETOOTH;
 533         sa->rc_channel = rfcomm_pi(sk)->channel;
 534         if (peer)
 535                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 536         else
 537                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 538
 539         *len = sizeof(struct sockaddr_rc);
 540         return 0;
 541 }
 542
 543 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 544                                struct msghdr *msg, size_t len)
 545 {
 546         struct sock *sk = sock->sk;
 547         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 548         struct sk_buff *skb;
 549         int sent = 0;
 550
 551         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 552                 return -ENOTCONN;
 553
 554         if (msg->msg_flags & MSG_OOB)
 555                 return -EOPNOTSUPP;
 556
 557         if (sk->sk_shutdown & SEND_SHUTDOWN)
 558                 return -EPIPE;
 559
 560         BT_DBG("sock %p, sk %p", sock, sk);
 561
 562         lock_sock(sk);
 563
 564         while (len) {
 565                 size_t size = min_t(size_t, len, d->mtu);
 566                 int err;
 567
 568                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 569                                 msg->msg_flags & MSG_DONTWAIT, &err);
 570                 if (!skb) {
 571                         if (sent == 0)
 572                                 sent = err;
 573                         break;
 574                 }
 575                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 576
 577                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 578                 if (err) {
 579                         kfree_skb(skb);
 580                         if (sent == 0)
 581                                 sent = err;
 582                         break;
 583                 }
 584
 585                 skb->priority = sk->sk_priority;
 586
 587                 err = rfcomm_dlc_send(d, skb);
 588                 if (err < 0) {
 589                         kfree_skb(skb);
 590                         if (sent == 0)
 591                                 sent = err;
 592                         break;
 593                 }
 594
 595                 sent += size;
 596                 len  -= size;
 597         }
 598
 599         release_sock(sk);
 600
 601         return sent;
 602 }
 603
 604 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 605                                struct msghdr *msg, size_t size, int flags)
 606 {
 607         struct sock *sk = sock->sk;
 608         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 609         int len;
 610
 611         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 612                 rfcomm_dlc_accept(d);
 613                 return 0;
 614         }
 615
 616         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 617
 618         lock_sock(sk);
 619         if (!(flags & MSG_PEEK) && len > 0)
 620                 atomic_sub(len, &sk->sk_rmem_alloc);
 621
 622         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 623                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 624         release_sock(sk);
 625
 626         return len;
 627 }
 628
 629 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 630 {
 631         struct sock *sk = sock->sk;
 632         int err = 0;
 633         u32 opt;
 634
 635         BT_DBG("sk %p", sk);
 636
 637         lock_sock(sk);
 638
 639         switch (optname) {
 640         case RFCOMM_LM:
 641                 if (get_user(opt, (u32 __user *) optval)) {
 642                         err = -EFAULT;
 643                         break;
 644                 }
 645
 646                 if (opt & RFCOMM_LM_AUTH)
 647                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 648                 if (opt & RFCOMM_LM_ENCRYPT)
 649                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 650                 if (opt & RFCOMM_LM_SECURE)
 651                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 652
 653                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 654                 break;
 655
 656         default:
 657                 err = -ENOPROTOOPT;
 658                 break;
 659         }
 660
 661         release_sock(sk);
 662         return err;
 663 }
 664
 665 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 666 {
 667         struct sock *sk = sock->sk;
 668         struct bt_security sec;
 669         int err = 0;
 670         size_t len;
 671         u32 opt;
 672
 673         BT_DBG("sk %p", sk);
 674
 675         if (level == SOL_RFCOMM)
 676                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 677
 678         if (level != SOL_BLUETOOTH)
 679                 return -ENOPROTOOPT;
 680
 681         lock_sock(sk);
 682
 683         switch (optname) {
 684         case BT_SECURITY:
 685                 if (sk->sk_type != SOCK_STREAM) {
 686                         err = -EINVAL;
 687                         break;
 688                 }
 689
 690                 sec.level = BT_SECURITY_LOW;
 691
 692                 len = min_t(unsigned int, sizeof(sec), optlen);
 693                 if (copy_from_user((char *) &sec, optval, len)) {
 694                         err = -EFAULT;
 695                         break;
 696                 }
 697
 698                 if (sec.level > BT_SECURITY_HIGH) {
 699                         err = -EINVAL;
 700                         break;
 701                 }
 702
 703                 rfcomm_pi(sk)->sec_level = sec.level;
 704                 break;
 705
 706         case BT_DEFER_SETUP:
 707                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 708                         err = -EINVAL;
 709                         break;
 710                 }
 711
 712                 if (get_user(opt, (u32 __user *) optval)) {
 713                         err = -EFAULT;
 714                         break;
 715                 }
 716
 717                 if (opt)
 718                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 719                 else
 720                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 721
 722                 break;
 723
 724         default:
 725                 err = -ENOPROTOOPT;
 726                 break;
 727         }
 728
 729         release_sock(sk);
 730         return err;
 731 }
 732
 733 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 734 {
 735         struct sock *sk = sock->sk;
 736         struct rfcomm_conninfo cinfo;
 737         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 738         int len, err = 0;
 739         u32 opt;
 740
 741         BT_DBG("sk %p", sk);
 742
 743         if (get_user(len, optlen))
 744                 return -EFAULT;
 745
 746         lock_sock(sk);
 747
 748         switch (optname) {
 749         case RFCOMM_LM:
 750                 switch (rfcomm_pi(sk)->sec_level) {
 751                 case BT_SECURITY_LOW:
 752                         opt = RFCOMM_LM_AUTH;
 753                         break;
 754                 case BT_SECURITY_MEDIUM:
 755                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 756                         break;
 757                 case BT_SECURITY_HIGH:
 758                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 759                                                         RFCOMM_LM_SECURE;
 760                         break;
 761                 default:
 762                         opt = 0;
 763                         break;
 764                 }
 765
 766                 if (rfcomm_pi(sk)->role_switch)
 767                         opt |= RFCOMM_LM_MASTER;
 768
 769                 if (put_user(opt, (u32 __user *) optval))
 770                         err = -EFAULT;
 771                 break;
 772
 773         case RFCOMM_CONNINFO:
 774                 if (sk->sk_state != BT_CONNECTED &&
 775                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 776                         err = -ENOTCONN;
 777                         break;
 778                 }
 779
 780                 memset(&cinfo, 0, sizeof(cinfo));
 781                 cinfo.hci_handle = conn->hcon->handle;
 782                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 783
 784                 len = min_t(unsigned int, len, sizeof(cinfo));
 785                 if (copy_to_user(optval, (char *) &cinfo, len))
 786                         err = -EFAULT;
 787
 788                 break;
 789
 790         default:
 791                 err = -ENOPROTOOPT;
 792                 break;
 793         }
 794
 795         release_sock(sk);
 796         return err;
 797 }
 798
 799 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 800 {
 801         struct sock *sk = sock->sk;
 802         struct bt_security sec;
 803         int len, err = 0;
 804
 805         BT_DBG("sk %p", sk);
 806
 807         if (level == SOL_RFCOMM)
 808                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 809
 810         if (level != SOL_BLUETOOTH)
 811                 return -ENOPROTOOPT;
 812
 813         if (get_user(len, optlen))
 814                 return -EFAULT;
 815
 816         lock_sock(sk);
 817
 818         switch (optname) {
 819         case BT_SECURITY:
 820                 if (sk->sk_type != SOCK_STREAM) {
 821                         err = -EINVAL;
 822                         break;
 823                 }
 824
 825                 sec.level = rfcomm_pi(sk)->sec_level;
 826                 sec.key_size = 0;
 827
 828                 len = min_t(unsigned int, len, sizeof(sec));
 829                 if (copy_to_user(optval, (char *) &sec, len))
 830                         err = -EFAULT;
 831
 832                 break;
 833
 834         case BT_DEFER_SETUP:
 835                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 836                         err = -EINVAL;
 837                         break;
 838                 }
 839
 840                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 841                              (u32 __user *) optval))
 842                         err = -EFAULT;
 843
 844                 break;
 845
 846         default:
 847                 err = -ENOPROTOOPT;
 848                 break;
 849         }
 850
 851         release_sock(sk);
 852         return err;
 853 }
 854
 855 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 856 {
 857         struct sock *sk __maybe_unused = sock->sk;
 858         int err;
 859
 860         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 861
 862         err = bt_sock_ioctl(sock, cmd, arg);
 863
 864         if (err == -ENOIOCTLCMD) {
 865 #ifdef CONFIG_BT_RFCOMM_TTY
 866                 lock_sock(sk);
 867                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 868                 release_sock(sk);
 869 #else
 870                 err = -EOPNOTSUPP;
 871 #endif
 872         }
 873
 874         return err;
 875 }
 876
 877 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 878 {
 879         struct sock *sk = sock->sk;
 880         int err = 0;
 881
 882         BT_DBG("sock %p, sk %p", sock, sk);
 883
 884         if (!sk)
 885                 return 0;
 886
 887         lock_sock(sk);
 888         if (!sk->sk_shutdown) {
 889                 sk->sk_shutdown = SHUTDOWN_MASK;
 890                 __rfcomm_sock_close(sk);
 891
 892                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 893                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 894         }
 895         release_sock(sk);
 896         return err;
 897 }
 898
 899 static int rfcomm_sock_release(struct socket *sock)
 900 {
 901         struct sock *sk = sock->sk;
 902         int err;
 903
 904         BT_DBG("sock %p, sk %p", sock, sk);
 905
 906         if (!sk)
 907                 return 0;
 908
 909         err = rfcomm_sock_shutdown(sock, 2);
 910
 911         sock_orphan(sk);
 912         rfcomm_sock_kill(sk);
 913         return err;
 914 }
 915
 916 /* ---- RFCOMM core layer callbacks ----
 917  *
 918  * called under rfcomm_lock()
 919  */
 920 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 921 {
 922         struct sock *sk, *parent;
 923         bdaddr_t src, dst;
 924         int result = 0;
 925
 926         BT_DBG("session %p channel %d", s, channel);
 927
 928         rfcomm_session_getaddr(s, &src, &dst);
 929
 930         /* Check if we have socket listening on channel */
 931         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 932         if (!parent)
 933                 return 0;
 934
 935         bh_lock_sock(parent);
 936
 937         /* Check for backlog size */
 938         if (sk_acceptq_is_full(parent)) {
 939                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 940                 goto done;
 941         }
 942
 943         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 944         if (!sk)
 945                 goto done;
 946
 947         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 948
 949         rfcomm_sock_init(sk, parent);
 950         bacpy(&bt_sk(sk)->src, &src);
 951         bacpy(&bt_sk(sk)->dst, &dst);
 952         rfcomm_pi(sk)->channel = channel;
 953
 954         sk->sk_state = BT_CONFIG;
 955         bt_accept_enqueue(parent, sk);
 956
 957         /* Accept connection and return socket DLC */
 958         *d = rfcomm_pi(sk)->dlc;
 959         result = 1;
 960
 961 done:
 962         bh_unlock_sock(parent);
 963
 964         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 965                 parent->sk_state_change(parent);
 966
 967         return result;
 968 }
 969
 970 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 971 {
 972         struct sock *sk;
 973         struct hlist_node *node;
 974
 975         read_lock(&rfcomm_sk_list.lock);
 976
 977         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 978                 seq_printf(f, "%pMR %pMR %d %d\n",
 979                            &bt_sk(sk)->src, &bt_sk(sk)->dst,
 980                            sk->sk_state, rfcomm_pi(sk)->channel);
 981         }
 982
 983         read_unlock(&rfcomm_sk_list.lock);
 984
 985         return 0;
 986 }
 987
 988 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
 989 {
 990         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
 991 }
 992
 993 static const struct file_operations rfcomm_sock_debugfs_fops = {
 994         .open           = rfcomm_sock_debugfs_open,
 995         .read           = seq_read,
 996         .llseek         = seq_lseek,
 997         .release        = single_release,
 998 };
 999
1000 static struct dentry *rfcomm_sock_debugfs;
1001
1002 static const struct proto_ops rfcomm_sock_ops = {
1003         .family         = PF_BLUETOOTH,
1004         .owner          = THIS_MODULE,
1005         .release        = rfcomm_sock_release,
1006         .bind           = rfcomm_sock_bind,
1007         .connect        = rfcomm_sock_connect,
1008         .listen         = rfcomm_sock_listen,
1009         .accept         = rfcomm_sock_accept,
1010         .getname        = rfcomm_sock_getname,
1011         .sendmsg        = rfcomm_sock_sendmsg,
1012         .recvmsg        = rfcomm_sock_recvmsg,
1013         .shutdown       = rfcomm_sock_shutdown,
1014         .setsockopt     = rfcomm_sock_setsockopt,
1015         .getsockopt     = rfcomm_sock_getsockopt,
1016         .ioctl          = rfcomm_sock_ioctl,
1017         .poll           = bt_sock_poll,
1018         .socketpair     = sock_no_socketpair,
1019         .mmap           = sock_no_mmap
1020 };
1021
1022 static const struct net_proto_family rfcomm_sock_family_ops = {
1023         .family         = PF_BLUETOOTH,
1024         .owner          = THIS_MODULE,
1025         .create         = rfcomm_sock_create
1026 };
1027
1028 int __init rfcomm_init_sockets(void)
1029 {
1030         int err;
1031
1032         err = proto_register(&rfcomm_proto, 0);
1033         if (err < 0)
1034                 return err;
1035
1036         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1037         if (err < 0) {
1038                 BT_ERR("RFCOMM socket layer registration failed");
1039                 goto error;
1040         }
1041
1042         err = bt_procfs_init(THIS_MODULE, &init_net, "rfcomm", &rfcomm_sk_list, NULL);
1043         if (err < 0) {
1044                 BT_ERR("Failed to create RFCOMM proc file");
1045                 bt_sock_unregister(BTPROTO_RFCOMM);
1046                 goto error;
1047         }
1048
1049         if (bt_debugfs) {
1050                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1051                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1052                 if (!rfcomm_sock_debugfs)
1053                         BT_ERR("Failed to create RFCOMM debug file");
1054         }
1055
1056         BT_INFO("RFCOMM socket layer initialized");
1057
1058         return 0;
1059
1060 error:
1061         proto_unregister(&rfcomm_proto);
1062         return err;
1063 }
1064
1065 void __exit rfcomm_cleanup_sockets(void)
1066 {
1067         bt_procfs_cleanup(&init_net, "rfcomm");
1068
1069         debugfs_remove(rfcomm_sock_debugfs);
1070
1071         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1072                 BT_ERR("RFCOMM socket layer unregistration failed");
1073
1074         proto_unregister(&rfcomm_proto);
1075 }