net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/rfcomm.h>
  35
  36 static const struct proto_ops rfcomm_sock_ops;
  37
  38 static struct bt_sock_list rfcomm_sk_list = {
  39         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  40 };
  41
  42 static void rfcomm_sock_close(struct sock *sk);
  43 static void rfcomm_sock_kill(struct sock *sk);
  44
  45 /* ---- DLC callbacks ----
  46  *
  47  * called under rfcomm_dlc_lock()
  48  */
  49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  50 {
  51         struct sock *sk = d->owner;
  52         if (!sk)
  53                 return;
  54
  55         atomic_add(skb->len, &sk->sk_rmem_alloc);
  56         skb_queue_tail(&sk->sk_receive_queue, skb);
  57         sk->sk_data_ready(sk, skb->len);
  58
  59         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  60                 rfcomm_dlc_throttle(d);
  61 }
  62
  63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  64 {
  65         struct sock *sk = d->owner, *parent;
  66         unsigned long flags;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         local_irq_save(flags);
  74         bh_lock_sock(sk);
  75
  76         if (err)
  77                 sk->sk_err = err;
  78
  79         sk->sk_state = d->state;
  80
  81         parent = bt_sk(sk)->parent;
  82         if (parent) {
  83                 if (d->state == BT_CLOSED) {
  84                         sock_set_flag(sk, SOCK_ZAPPED);
  85                         bt_accept_unlink(sk);
  86                 }
  87                 parent->sk_data_ready(parent, 0);
  88         } else {
  89                 if (d->state == BT_CONNECTED)
  90                         rfcomm_session_getaddr(d->session,
  91                                                &rfcomm_pi(sk)->src, NULL);
  92                 sk->sk_state_change(sk);
  93         }
  94
  95         bh_unlock_sock(sk);
  96         local_irq_restore(flags);
  97
  98         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  99                 /* We have to drop DLC lock here, otherwise
 100                  * rfcomm_sock_destruct() will dead lock. */
 101                 rfcomm_dlc_unlock(d);
 102                 rfcomm_sock_kill(sk);
 103                 rfcomm_dlc_lock(d);
 104         }
 105 }
 106
 107 /* ---- Socket functions ---- */
 108 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
 109 {
 110         struct sock *sk = NULL;
 111
 112         sk_for_each(sk, &rfcomm_sk_list.head) {
 113                 if (rfcomm_pi(sk)->channel != channel)
 114                         continue;
 115
 116                 if (bacmp(&rfcomm_pi(sk)->src, src))
 117                         continue;
 118
 119                 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
 120                         break;
 121         }
 122
 123         return sk ? sk : NULL;
 124 }
 125
 126 /* Find socket with channel and source bdaddr.
 127  * Returns closest match.
 128  */
 129 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 130 {
 131         struct sock *sk = NULL, *sk1 = NULL;
 132
 133         read_lock(&rfcomm_sk_list.lock);
 134
 135         sk_for_each(sk, &rfcomm_sk_list.head) {
 136                 if (state && sk->sk_state != state)
 137                         continue;
 138
 139                 if (rfcomm_pi(sk)->channel == channel) {
 140                         /* Exact match. */
 141                         if (!bacmp(&rfcomm_pi(sk)->src, src))
 142                                 break;
 143
 144                         /* Closest match */
 145                         if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
 146                                 sk1 = sk;
 147                 }
 148         }
 149
 150         read_unlock(&rfcomm_sk_list.lock);
 151
 152         return sk ? sk : sk1;
 153 }
 154
 155 static void rfcomm_sock_destruct(struct sock *sk)
 156 {
 157         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 158
 159         BT_DBG("sk %p dlc %p", sk, d);
 160
 161         skb_queue_purge(&sk->sk_receive_queue);
 162         skb_queue_purge(&sk->sk_write_queue);
 163
 164         rfcomm_dlc_lock(d);
 165         rfcomm_pi(sk)->dlc = NULL;
 166
 167         /* Detach DLC if it's owned by this socket */
 168         if (d->owner == sk)
 169                 d->owner = NULL;
 170         rfcomm_dlc_unlock(d);
 171
 172         rfcomm_dlc_put(d);
 173 }
 174
 175 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 176 {
 177         struct sock *sk;
 178
 179         BT_DBG("parent %p", parent);
 180
 181         /* Close not yet accepted dlcs */
 182         while ((sk = bt_accept_dequeue(parent, NULL))) {
 183                 rfcomm_sock_close(sk);
 184                 rfcomm_sock_kill(sk);
 185         }
 186
 187         parent->sk_state  = BT_CLOSED;
 188         sock_set_flag(parent, SOCK_ZAPPED);
 189 }
 190
 191 /* Kill socket (only if zapped and orphan)
 192  * Must be called on unlocked socket.
 193  */
 194 static void rfcomm_sock_kill(struct sock *sk)
 195 {
 196         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 197                 return;
 198
 199         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 200
 201         /* Kill poor orphan */
 202         bt_sock_unlink(&rfcomm_sk_list, sk);
 203         sock_set_flag(sk, SOCK_DEAD);
 204         sock_put(sk);
 205 }
 206
 207 static void __rfcomm_sock_close(struct sock *sk)
 208 {
 209         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 210
 211         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 212
 213         switch (sk->sk_state) {
 214         case BT_LISTEN:
 215                 rfcomm_sock_cleanup_listen(sk);
 216                 break;
 217
 218         case BT_CONNECT:
 219         case BT_CONNECT2:
 220         case BT_CONFIG:
 221         case BT_CONNECTED:
 222                 rfcomm_dlc_close(d, 0);
 223
 224         default:
 225                 sock_set_flag(sk, SOCK_ZAPPED);
 226                 break;
 227         }
 228 }
 229
 230 /* Close socket.
 231  * Must be called on unlocked socket.
 232  */
 233 static void rfcomm_sock_close(struct sock *sk)
 234 {
 235         lock_sock(sk);
 236         __rfcomm_sock_close(sk);
 237         release_sock(sk);
 238 }
 239
 240 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 241 {
 242         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 243
 244         BT_DBG("sk %p", sk);
 245
 246         if (parent) {
 247                 sk->sk_type = parent->sk_type;
 248                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 249                                                 &bt_sk(parent)->flags);
 250
 251                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 252                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 253
 254                 security_sk_clone(parent, sk);
 255         } else {
 256                 pi->dlc->defer_setup = 0;
 257
 258                 pi->sec_level = BT_SECURITY_LOW;
 259                 pi->role_switch = 0;
 260         }
 261
 262         pi->dlc->sec_level = pi->sec_level;
 263         pi->dlc->role_switch = pi->role_switch;
 264 }
 265
 266 static struct proto rfcomm_proto = {
 267         .name           = "RFCOMM",
 268         .owner          = THIS_MODULE,
 269         .obj_size       = sizeof(struct rfcomm_pinfo)
 270 };
 271
 272 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 273 {
 274         struct rfcomm_dlc *d;
 275         struct sock *sk;
 276
 277         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 278         if (!sk)
 279                 return NULL;
 280
 281         sock_init_data(sock, sk);
 282         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 283
 284         d = rfcomm_dlc_alloc(prio);
 285         if (!d) {
 286                 sk_free(sk);
 287                 return NULL;
 288         }
 289
 290         d->data_ready   = rfcomm_sk_data_ready;
 291         d->state_change = rfcomm_sk_state_change;
 292
 293         rfcomm_pi(sk)->dlc = d;
 294         d->owner = sk;
 295
 296         sk->sk_destruct = rfcomm_sock_destruct;
 297         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 298
 299         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 300         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 301
 302         sock_reset_flag(sk, SOCK_ZAPPED);
 303
 304         sk->sk_protocol = proto;
 305         sk->sk_state    = BT_OPEN;
 306
 307         bt_sock_link(&rfcomm_sk_list, sk);
 308
 309         BT_DBG("sk %p", sk);
 310         return sk;
 311 }
 312
 313 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 314                               int protocol, int kern)
 315 {
 316         struct sock *sk;
 317
 318         BT_DBG("sock %p", sock);
 319
 320         sock->state = SS_UNCONNECTED;
 321
 322         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 323                 return -ESOCKTNOSUPPORT;
 324
 325         sock->ops = &rfcomm_sock_ops;
 326
 327         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 328         if (!sk)
 329                 return -ENOMEM;
 330
 331         rfcomm_sock_init(sk, NULL);
 332         return 0;
 333 }
 334
 335 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 336 {
 337         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 338         struct sock *sk = sock->sk;
 339         int chan = sa->rc_channel;
 340         int err = 0;
 341
 342         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
 343
 344         if (!addr || addr->sa_family != AF_BLUETOOTH)
 345                 return -EINVAL;
 346
 347         lock_sock(sk);
 348
 349         if (sk->sk_state != BT_OPEN) {
 350                 err = -EBADFD;
 351                 goto done;
 352         }
 353
 354         if (sk->sk_type != SOCK_STREAM) {
 355                 err = -EINVAL;
 356                 goto done;
 357         }
 358
 359         write_lock(&rfcomm_sk_list.lock);
 360
 361         if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
 362                 err = -EADDRINUSE;
 363         } else {
 364                 /* Save source address */
 365                 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
 366                 rfcomm_pi(sk)->channel = chan;
 367                 sk->sk_state = BT_BOUND;
 368         }
 369
 370         write_unlock(&rfcomm_sk_list.lock);
 371
 372 done:
 373         release_sock(sk);
 374         return err;
 375 }
 376
 377 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 378 {
 379         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 380         struct sock *sk = sock->sk;
 381         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 382         int err = 0;
 383
 384         BT_DBG("sk %p", sk);
 385
 386         if (alen < sizeof(struct sockaddr_rc) ||
 387             addr->sa_family != AF_BLUETOOTH)
 388                 return -EINVAL;
 389
 390         lock_sock(sk);
 391
 392         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 393                 err = -EBADFD;
 394                 goto done;
 395         }
 396
 397         if (sk->sk_type != SOCK_STREAM) {
 398                 err = -EINVAL;
 399                 goto done;
 400         }
 401
 402         sk->sk_state = BT_CONNECT;
 403         bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
 404         rfcomm_pi(sk)->channel = sa->rc_channel;
 405
 406         d->sec_level = rfcomm_pi(sk)->sec_level;
 407         d->role_switch = rfcomm_pi(sk)->role_switch;
 408
 409         err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
 410                               sa->rc_channel);
 411         if (!err)
 412                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 413                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 414
 415 done:
 416         release_sock(sk);
 417         return err;
 418 }
 419
 420 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 421 {
 422         struct sock *sk = sock->sk;
 423         int err = 0;
 424
 425         BT_DBG("sk %p backlog %d", sk, backlog);
 426
 427         lock_sock(sk);
 428
 429         if (sk->sk_state != BT_BOUND) {
 430                 err = -EBADFD;
 431                 goto done;
 432         }
 433
 434         if (sk->sk_type != SOCK_STREAM) {
 435                 err = -EINVAL;
 436                 goto done;
 437         }
 438
 439         if (!rfcomm_pi(sk)->channel) {
 440                 bdaddr_t *src = &rfcomm_pi(sk)->src;
 441                 u8 channel;
 442
 443                 err = -EINVAL;
 444
 445                 write_lock(&rfcomm_sk_list.lock);
 446
 447                 for (channel = 1; channel < 31; channel++)
 448                         if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
 449                                 rfcomm_pi(sk)->channel = channel;
 450                                 err = 0;
 451                                 break;
 452                         }
 453
 454                 write_unlock(&rfcomm_sk_list.lock);
 455
 456                 if (err < 0)
 457                         goto done;
 458         }
 459
 460         sk->sk_max_ack_backlog = backlog;
 461         sk->sk_ack_backlog = 0;
 462         sk->sk_state = BT_LISTEN;
 463
 464 done:
 465         release_sock(sk);
 466         return err;
 467 }
 468
 469 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 470 {
 471         DECLARE_WAITQUEUE(wait, current);
 472         struct sock *sk = sock->sk, *nsk;
 473         long timeo;
 474         int err = 0;
 475
 476         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 477
 478         if (sk->sk_type != SOCK_STREAM) {
 479                 err = -EINVAL;
 480                 goto done;
 481         }
 482
 483         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 484
 485         BT_DBG("sk %p timeo %ld", sk, timeo);
 486
 487         /* Wait for an incoming connection. (wake-one). */
 488         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 489         while (1) {
 490                 set_current_state(TASK_INTERRUPTIBLE);
 491
 492                 if (sk->sk_state != BT_LISTEN) {
 493                         err = -EBADFD;
 494                         break;
 495                 }
 496
 497                 nsk = bt_accept_dequeue(sk, newsock);
 498                 if (nsk)
 499                         break;
 500
 501                 if (!timeo) {
 502                         err = -EAGAIN;
 503                         break;
 504                 }
 505
 506                 if (signal_pending(current)) {
 507                         err = sock_intr_errno(timeo);
 508                         break;
 509                 }
 510
 511                 release_sock(sk);
 512                 timeo = schedule_timeout(timeo);
 513                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 514         }
 515         __set_current_state(TASK_RUNNING);
 516         remove_wait_queue(sk_sleep(sk), &wait);
 517
 518         if (err)
 519                 goto done;
 520
 521         newsock->state = SS_CONNECTED;
 522
 523         BT_DBG("new socket %p", nsk);
 524
 525 done:
 526         release_sock(sk);
 527         return err;
 528 }
 529
 530 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 531 {
 532         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 533         struct sock *sk = sock->sk;
 534
 535         BT_DBG("sock %p, sk %p", sock, sk);
 536
 537         if (peer && sk->sk_state != BT_CONNECTED)
 538                 return -ENOTCONN;
 539
 540         memset(sa, 0, sizeof(*sa));
 541         sa->rc_family  = AF_BLUETOOTH;
 542         sa->rc_channel = rfcomm_pi(sk)->channel;
 543         if (peer)
 544                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
 545         else
 546                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 547
 548         *len = sizeof(struct sockaddr_rc);
 549         return 0;
 550 }
 551
 552 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 553                                struct msghdr *msg, size_t len)
 554 {
 555         struct sock *sk = sock->sk;
 556         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 557         struct sk_buff *skb;
 558         int sent;
 559
 560         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 561                 return -ENOTCONN;
 562
 563         if (msg->msg_flags & MSG_OOB)
 564                 return -EOPNOTSUPP;
 565
 566         if (sk->sk_shutdown & SEND_SHUTDOWN)
 567                 return -EPIPE;
 568
 569         BT_DBG("sock %p, sk %p", sock, sk);
 570
 571         lock_sock(sk);
 572
 573         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 574         if (sent)
 575                 goto done;
 576
 577         while (len) {
 578                 size_t size = min_t(size_t, len, d->mtu);
 579                 int err;
 580
 581                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 582                                 msg->msg_flags & MSG_DONTWAIT, &err);
 583                 if (!skb) {
 584                         if (sent == 0)
 585                                 sent = err;
 586                         break;
 587                 }
 588                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 589
 590                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 591                 if (err) {
 592                         kfree_skb(skb);
 593                         if (sent == 0)
 594                                 sent = err;
 595                         break;
 596                 }
 597
 598                 skb->priority = sk->sk_priority;
 599
 600                 err = rfcomm_dlc_send(d, skb);
 601                 if (err < 0) {
 602                         kfree_skb(skb);
 603                         if (sent == 0)
 604                                 sent = err;
 605                         break;
 606                 }
 607
 608                 sent += size;
 609                 len  -= size;
 610         }
 611
 612 done:
 613         release_sock(sk);
 614
 615         return sent;
 616 }
 617
 618 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 619                                struct msghdr *msg, size_t size, int flags)
 620 {
 621         struct sock *sk = sock->sk;
 622         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 623         int len;
 624
 625         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 626                 rfcomm_dlc_accept(d);
 627                 return 0;
 628         }
 629
 630         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 631
 632         lock_sock(sk);
 633         if (!(flags & MSG_PEEK) && len > 0)
 634                 atomic_sub(len, &sk->sk_rmem_alloc);
 635
 636         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 637                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 638         release_sock(sk);
 639
 640         return len;
 641 }
 642
 643 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 644 {
 645         struct sock *sk = sock->sk;
 646         int err = 0;
 647         u32 opt;
 648
 649         BT_DBG("sk %p", sk);
 650
 651         lock_sock(sk);
 652
 653         switch (optname) {
 654         case RFCOMM_LM:
 655                 if (get_user(opt, (u32 __user *) optval)) {
 656                         err = -EFAULT;
 657                         break;
 658                 }
 659
 660                 if (opt & RFCOMM_LM_FIPS) {
 661                         err = -EINVAL;
 662                         break;
 663                 }
 664
 665                 if (opt & RFCOMM_LM_AUTH)
 666                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 667                 if (opt & RFCOMM_LM_ENCRYPT)
 668                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 669                 if (opt & RFCOMM_LM_SECURE)
 670                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 671
 672                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 673                 break;
 674
 675         default:
 676                 err = -ENOPROTOOPT;
 677                 break;
 678         }
 679
 680         release_sock(sk);
 681         return err;
 682 }
 683
 684 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 685 {
 686         struct sock *sk = sock->sk;
 687         struct bt_security sec;
 688         int err = 0;
 689         size_t len;
 690         u32 opt;
 691
 692         BT_DBG("sk %p", sk);
 693
 694         if (level == SOL_RFCOMM)
 695                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 696
 697         if (level != SOL_BLUETOOTH)
 698                 return -ENOPROTOOPT;
 699
 700         lock_sock(sk);
 701
 702         switch (optname) {
 703         case BT_SECURITY:
 704                 if (sk->sk_type != SOCK_STREAM) {
 705                         err = -EINVAL;
 706                         break;
 707                 }
 708
 709                 sec.level = BT_SECURITY_LOW;
 710
 711                 len = min_t(unsigned int, sizeof(sec), optlen);
 712                 if (copy_from_user((char *) &sec, optval, len)) {
 713                         err = -EFAULT;
 714                         break;
 715                 }
 716
 717                 if (sec.level > BT_SECURITY_HIGH) {
 718                         err = -EINVAL;
 719                         break;
 720                 }
 721
 722                 rfcomm_pi(sk)->sec_level = sec.level;
 723                 break;
 724
 725         case BT_DEFER_SETUP:
 726                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 727                         err = -EINVAL;
 728                         break;
 729                 }
 730
 731                 if (get_user(opt, (u32 __user *) optval)) {
 732                         err = -EFAULT;
 733                         break;
 734                 }
 735
 736                 if (opt)
 737                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 738                 else
 739                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 740
 741                 break;
 742
 743         default:
 744                 err = -ENOPROTOOPT;
 745                 break;
 746         }
 747
 748         release_sock(sk);
 749         return err;
 750 }
 751
 752 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 753 {
 754         struct sock *sk = sock->sk;
 755         struct sock *l2cap_sk;
 756         struct l2cap_conn *conn;
 757         struct rfcomm_conninfo cinfo;
 758         int len, err = 0;
 759         u32 opt;
 760
 761         BT_DBG("sk %p", sk);
 762
 763         if (get_user(len, optlen))
 764                 return -EFAULT;
 765
 766         lock_sock(sk);
 767
 768         switch (optname) {
 769         case RFCOMM_LM:
 770                 switch (rfcomm_pi(sk)->sec_level) {
 771                 case BT_SECURITY_LOW:
 772                         opt = RFCOMM_LM_AUTH;
 773                         break;
 774                 case BT_SECURITY_MEDIUM:
 775                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 776                         break;
 777                 case BT_SECURITY_HIGH:
 778                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 779                               RFCOMM_LM_SECURE;
 780                         break;
 781                 case BT_SECURITY_FIPS:
 782                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 783                               RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
 784                         break;
 785                 default:
 786                         opt = 0;
 787                         break;
 788                 }
 789
 790                 if (rfcomm_pi(sk)->role_switch)
 791                         opt |= RFCOMM_LM_MASTER;
 792
 793                 if (put_user(opt, (u32 __user *) optval))
 794                         err = -EFAULT;
 795
 796                 break;
 797
 798         case RFCOMM_CONNINFO:
 799                 if (sk->sk_state != BT_CONNECTED &&
 800                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 801                         err = -ENOTCONN;
 802                         break;
 803                 }
 804
 805                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 806                 conn = l2cap_pi(l2cap_sk)->chan->conn;
 807
 808                 memset(&cinfo, 0, sizeof(cinfo));
 809                 cinfo.hci_handle = conn->hcon->handle;
 810                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 811
 812                 len = min_t(unsigned int, len, sizeof(cinfo));
 813                 if (copy_to_user(optval, (char *) &cinfo, len))
 814                         err = -EFAULT;
 815
 816                 break;
 817
 818         default:
 819                 err = -ENOPROTOOPT;
 820                 break;
 821         }
 822
 823         release_sock(sk);
 824         return err;
 825 }
 826
 827 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 828 {
 829         struct sock *sk = sock->sk;
 830         struct bt_security sec;
 831         int len, err = 0;
 832
 833         BT_DBG("sk %p", sk);
 834
 835         if (level == SOL_RFCOMM)
 836                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 837
 838         if (level != SOL_BLUETOOTH)
 839                 return -ENOPROTOOPT;
 840
 841         if (get_user(len, optlen))
 842                 return -EFAULT;
 843
 844         lock_sock(sk);
 845
 846         switch (optname) {
 847         case BT_SECURITY:
 848                 if (sk->sk_type != SOCK_STREAM) {
 849                         err = -EINVAL;
 850                         break;
 851                 }
 852
 853                 sec.level = rfcomm_pi(sk)->sec_level;
 854                 sec.key_size = 0;
 855
 856                 len = min_t(unsigned int, len, sizeof(sec));
 857                 if (copy_to_user(optval, (char *) &sec, len))
 858                         err = -EFAULT;
 859
 860                 break;
 861
 862         case BT_DEFER_SETUP:
 863                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 864                         err = -EINVAL;
 865                         break;
 866                 }
 867
 868                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 869                              (u32 __user *) optval))
 870                         err = -EFAULT;
 871
 872                 break;
 873
 874         default:
 875                 err = -ENOPROTOOPT;
 876                 break;
 877         }
 878
 879         release_sock(sk);
 880         return err;
 881 }
 882
 883 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 884 {
 885         struct sock *sk __maybe_unused = sock->sk;
 886         int err;
 887
 888         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 889
 890         err = bt_sock_ioctl(sock, cmd, arg);
 891
 892         if (err == -ENOIOCTLCMD) {
 893 #ifdef CONFIG_BT_RFCOMM_TTY
 894                 lock_sock(sk);
 895                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 896                 release_sock(sk);
 897 #else
 898                 err = -EOPNOTSUPP;
 899 #endif
 900         }
 901
 902         return err;
 903 }
 904
 905 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 906 {
 907         struct sock *sk = sock->sk;
 908         int err = 0;
 909
 910         BT_DBG("sock %p, sk %p", sock, sk);
 911
 912         if (!sk)
 913                 return 0;
 914
 915         lock_sock(sk);
 916         if (!sk->sk_shutdown) {
 917                 sk->sk_shutdown = SHUTDOWN_MASK;
 918                 __rfcomm_sock_close(sk);
 919
 920                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 921                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 922         }
 923         release_sock(sk);
 924         return err;
 925 }
 926
 927 static int rfcomm_sock_release(struct socket *sock)
 928 {
 929         struct sock *sk = sock->sk;
 930         int err;
 931
 932         BT_DBG("sock %p, sk %p", sock, sk);
 933
 934         if (!sk)
 935                 return 0;
 936
 937         err = rfcomm_sock_shutdown(sock, 2);
 938
 939         sock_orphan(sk);
 940         rfcomm_sock_kill(sk);
 941         return err;
 942 }
 943
 944 /* ---- RFCOMM core layer callbacks ----
 945  *
 946  * called under rfcomm_lock()
 947  */
 948 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 949 {
 950         struct sock *sk, *parent;
 951         bdaddr_t src, dst;
 952         int result = 0;
 953
 954         BT_DBG("session %p channel %d", s, channel);
 955
 956         rfcomm_session_getaddr(s, &src, &dst);
 957
 958         /* Check if we have socket listening on channel */
 959         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 960         if (!parent)
 961                 return 0;
 962
 963         bh_lock_sock(parent);
 964
 965         /* Check for backlog size */
 966         if (sk_acceptq_is_full(parent)) {
 967                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 968                 goto done;
 969         }
 970
 971         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 972         if (!sk)
 973                 goto done;
 974
 975         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 976
 977         rfcomm_sock_init(sk, parent);
 978         bacpy(&rfcomm_pi(sk)->src, &src);
 979         bacpy(&rfcomm_pi(sk)->dst, &dst);
 980         rfcomm_pi(sk)->channel = channel;
 981
 982         sk->sk_state = BT_CONFIG;
 983         bt_accept_enqueue(parent, sk);
 984
 985         /* Accept connection and return socket DLC */
 986         *d = rfcomm_pi(sk)->dlc;
 987         result = 1;
 988
 989 done:
 990         bh_unlock_sock(parent);
 991
 992         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 993                 parent->sk_state_change(parent);
 994
 995         return result;
 996 }
 997
 998 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 999 {
1000         struct sock *sk;
1001
1002         read_lock(&rfcomm_sk_list.lock);
1003
1004         sk_for_each(sk, &rfcomm_sk_list.head) {
1005                 seq_printf(f, "%pMR %pMR %d %d\n",
1006                            &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1007                            sk->sk_state, rfcomm_pi(sk)->channel);
1008         }
1009
1010         read_unlock(&rfcomm_sk_list.lock);
1011
1012         return 0;
1013 }
1014
1015 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
1016 {
1017         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1018 }
1019
1020 static const struct file_operations rfcomm_sock_debugfs_fops = {
1021         .open           = rfcomm_sock_debugfs_open,
1022         .read           = seq_read,
1023         .llseek         = seq_lseek,
1024         .release        = single_release,
1025 };
1026
1027 static struct dentry *rfcomm_sock_debugfs;
1028
1029 static const struct proto_ops rfcomm_sock_ops = {
1030         .family         = PF_BLUETOOTH,
1031         .owner          = THIS_MODULE,
1032         .release        = rfcomm_sock_release,
1033         .bind           = rfcomm_sock_bind,
1034         .connect        = rfcomm_sock_connect,
1035         .listen         = rfcomm_sock_listen,
1036         .accept         = rfcomm_sock_accept,
1037         .getname        = rfcomm_sock_getname,
1038         .sendmsg        = rfcomm_sock_sendmsg,
1039         .recvmsg        = rfcomm_sock_recvmsg,
1040         .shutdown       = rfcomm_sock_shutdown,
1041         .setsockopt     = rfcomm_sock_setsockopt,
1042         .getsockopt     = rfcomm_sock_getsockopt,
1043         .ioctl          = rfcomm_sock_ioctl,
1044         .poll           = bt_sock_poll,
1045         .socketpair     = sock_no_socketpair,
1046         .mmap           = sock_no_mmap
1047 };
1048
1049 static const struct net_proto_family rfcomm_sock_family_ops = {
1050         .family         = PF_BLUETOOTH,
1051         .owner          = THIS_MODULE,
1052         .create         = rfcomm_sock_create
1053 };
1054
1055 int __init rfcomm_init_sockets(void)
1056 {
1057         int err;
1058
1059         err = proto_register(&rfcomm_proto, 0);
1060         if (err < 0)
1061                 return err;
1062
1063         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1064         if (err < 0) {
1065                 BT_ERR("RFCOMM socket layer registration failed");
1066                 goto error;
1067         }
1068
1069         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1070         if (err < 0) {
1071                 BT_ERR("Failed to create RFCOMM proc file");
1072                 bt_sock_unregister(BTPROTO_RFCOMM);
1073                 goto error;
1074         }
1075
1076         BT_INFO("RFCOMM socket layer initialized");
1077
1078         if (IS_ERR_OR_NULL(bt_debugfs))
1079                 return 0;
1080
1081         rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1082                                                   bt_debugfs, NULL,
1083                                                   &rfcomm_sock_debugfs_fops);
1084
1085         return 0;
1086
1087 error:
1088         proto_unregister(&rfcomm_proto);
1089         return err;
1090 }
1091
1092 void __exit rfcomm_cleanup_sockets(void)
1093 {
1094         bt_procfs_cleanup(&init_net, "rfcomm");
1095
1096         debugfs_remove(rfcomm_sock_debugfs);
1097
1098         bt_sock_unregister(BTPROTO_RFCOMM);
1099
1100         proto_unregister(&rfcomm_proto);
1101 }