net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27 #include <linux/compat.h>
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/sched/signal.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/l2cap.h>
  35 #include <net/bluetooth/rfcomm.h>
  36
  37 static const struct proto_ops rfcomm_sock_ops;
  38
  39 static struct bt_sock_list rfcomm_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  41 };
  42
  43 static void rfcomm_sock_close(struct sock *sk);
  44 static void rfcomm_sock_kill(struct sock *sk);
  45
  46 /* ---- DLC callbacks ----
  47  *
  48  * called under rfcomm_dlc_lock()
  49  */
  50 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  51 {
  52         struct sock *sk = d->owner;
  53         if (!sk)
  54                 return;
  55
  56         atomic_add(skb->len, &sk->sk_rmem_alloc);
  57         skb_queue_tail(&sk->sk_receive_queue, skb);
  58         sk->sk_data_ready(sk);
  59
  60         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  61                 rfcomm_dlc_throttle(d);
  62 }
  63
  64 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  65 {
  66         struct sock *sk = d->owner, *parent;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         lock_sock(sk);
  74
  75         if (err)
  76                 sk->sk_err = err;
  77
  78         sk->sk_state = d->state;
  79
  80         parent = bt_sk(sk)->parent;
  81         if (parent) {
  82                 if (d->state == BT_CLOSED) {
  83                         sock_set_flag(sk, SOCK_ZAPPED);
  84                         bt_accept_unlink(sk);
  85                 }
  86                 parent->sk_data_ready(parent);
  87         } else {
  88                 if (d->state == BT_CONNECTED)
  89                         rfcomm_session_getaddr(d->session,
  90                                                &rfcomm_pi(sk)->src, NULL);
  91                 sk->sk_state_change(sk);
  92         }
  93
  94         release_sock(sk);
  95
  96         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  97                 /* We have to drop DLC lock here, otherwise
  98                  * rfcomm_sock_destruct() will dead lock. */
  99                 rfcomm_dlc_unlock(d);
 100                 rfcomm_sock_kill(sk);
 101                 rfcomm_dlc_lock(d);
 102         }
 103 }
 104
 105 /* ---- Socket functions ---- */
 106 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
 107 {
 108         struct sock *sk = NULL;
 109
 110         sk_for_each(sk, &rfcomm_sk_list.head) {
 111                 if (rfcomm_pi(sk)->channel != channel)
 112                         continue;
 113
 114                 if (bacmp(&rfcomm_pi(sk)->src, src))
 115                         continue;
 116
 117                 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
 118                         break;
 119         }
 120
 121         return sk ? sk : NULL;
 122 }
 123
 124 /* Find socket with channel and source bdaddr.
 125  * Returns closest match.
 126  */
 127 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 128 {
 129         struct sock *sk = NULL, *sk1 = NULL;
 130
 131         read_lock(&rfcomm_sk_list.lock);
 132
 133         sk_for_each(sk, &rfcomm_sk_list.head) {
 134                 if (state && sk->sk_state != state)
 135                         continue;
 136
 137                 if (rfcomm_pi(sk)->channel == channel) {
 138                         /* Exact match. */
 139                         if (!bacmp(&rfcomm_pi(sk)->src, src))
 140                                 break;
 141
 142                         /* Closest match */
 143                         if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
 144                                 sk1 = sk;
 145                 }
 146         }
 147
 148         read_unlock(&rfcomm_sk_list.lock);
 149
 150         return sk ? sk : sk1;
 151 }
 152
 153 static void rfcomm_sock_destruct(struct sock *sk)
 154 {
 155         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 156
 157         BT_DBG("sk %p dlc %p", sk, d);
 158
 159         skb_queue_purge(&sk->sk_receive_queue);
 160         skb_queue_purge(&sk->sk_write_queue);
 161
 162         rfcomm_dlc_lock(d);
 163         rfcomm_pi(sk)->dlc = NULL;
 164
 165         /* Detach DLC if it's owned by this socket */
 166         if (d->owner == sk)
 167                 d->owner = NULL;
 168         rfcomm_dlc_unlock(d);
 169
 170         rfcomm_dlc_put(d);
 171 }
 172
 173 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 174 {
 175         struct sock *sk;
 176
 177         BT_DBG("parent %p", parent);
 178
 179         /* Close not yet accepted dlcs */
 180         while ((sk = bt_accept_dequeue(parent, NULL))) {
 181                 rfcomm_sock_close(sk);
 182                 rfcomm_sock_kill(sk);
 183         }
 184
 185         parent->sk_state  = BT_CLOSED;
 186         sock_set_flag(parent, SOCK_ZAPPED);
 187 }
 188
 189 /* Kill socket (only if zapped and orphan)
 190  * Must be called on unlocked socket.
 191  */
 192 static void rfcomm_sock_kill(struct sock *sk)
 193 {
 194         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 195                 return;
 196
 197         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
 198
 199         /* Kill poor orphan */
 200         bt_sock_unlink(&rfcomm_sk_list, sk);
 201         sock_set_flag(sk, SOCK_DEAD);
 202         sock_put(sk);
 203 }
 204
 205 static void __rfcomm_sock_close(struct sock *sk)
 206 {
 207         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 208
 209         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 210
 211         switch (sk->sk_state) {
 212         case BT_LISTEN:
 213                 rfcomm_sock_cleanup_listen(sk);
 214                 break;
 215
 216         case BT_CONNECT:
 217         case BT_CONNECT2:
 218         case BT_CONFIG:
 219         case BT_CONNECTED:
 220                 rfcomm_dlc_close(d, 0);
 221                 fallthrough;
 222
 223         default:
 224                 sock_set_flag(sk, SOCK_ZAPPED);
 225                 break;
 226         }
 227 }
 228
 229 /* Close socket.
 230  * Must be called on unlocked socket.
 231  */
 232 static void rfcomm_sock_close(struct sock *sk)
 233 {
 234         lock_sock(sk);
 235         __rfcomm_sock_close(sk);
 236         release_sock(sk);
 237 }
 238
 239 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 240 {
 241         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 242
 243         BT_DBG("sk %p", sk);
 244
 245         if (parent) {
 246                 sk->sk_type = parent->sk_type;
 247                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 248                                                 &bt_sk(parent)->flags);
 249
 250                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 251                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 252
 253                 security_sk_clone(parent, sk);
 254         } else {
 255                 pi->dlc->defer_setup = 0;
 256
 257                 pi->sec_level = BT_SECURITY_LOW;
 258                 pi->role_switch = 0;
 259         }
 260
 261         pi->dlc->sec_level = pi->sec_level;
 262         pi->dlc->role_switch = pi->role_switch;
 263 }
 264
 265 static struct proto rfcomm_proto = {
 266         .name           = "RFCOMM",
 267         .owner          = THIS_MODULE,
 268         .obj_size       = sizeof(struct rfcomm_pinfo)
 269 };
 270
 271 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern)
 272 {
 273         struct rfcomm_dlc *d;
 274         struct sock *sk;
 275
 276         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern);
 277         if (!sk)
 278                 return NULL;
 279
 280         sock_init_data(sock, sk);
 281         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 282
 283         d = rfcomm_dlc_alloc(prio);
 284         if (!d) {
 285                 sk_free(sk);
 286                 return NULL;
 287         }
 288
 289         d->data_ready   = rfcomm_sk_data_ready;
 290         d->state_change = rfcomm_sk_state_change;
 291
 292         rfcomm_pi(sk)->dlc = d;
 293         d->owner = sk;
 294
 295         sk->sk_destruct = rfcomm_sock_destruct;
 296         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 297
 298         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 299         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 300
 301         sock_reset_flag(sk, SOCK_ZAPPED);
 302
 303         sk->sk_protocol = proto;
 304         sk->sk_state    = BT_OPEN;
 305
 306         bt_sock_link(&rfcomm_sk_list, sk);
 307
 308         BT_DBG("sk %p", sk);
 309         return sk;
 310 }
 311
 312 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 313                               int protocol, int kern)
 314 {
 315         struct sock *sk;
 316
 317         BT_DBG("sock %p", sock);
 318
 319         sock->state = SS_UNCONNECTED;
 320
 321         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 322                 return -ESOCKTNOSUPPORT;
 323
 324         sock->ops = &rfcomm_sock_ops;
 325
 326         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
 327         if (!sk)
 328                 return -ENOMEM;
 329
 330         rfcomm_sock_init(sk, NULL);
 331         return 0;
 332 }
 333
 334 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 335 {
 336         struct sockaddr_rc sa;
 337         struct sock *sk = sock->sk;
 338         int len, err = 0;
 339
 340         if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
 341             addr->sa_family != AF_BLUETOOTH)
 342                 return -EINVAL;
 343
 344         memset(&sa, 0, sizeof(sa));
 345         len = min_t(unsigned int, sizeof(sa), addr_len);
 346         memcpy(&sa, addr, len);
 347
 348         BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
 349
 350         lock_sock(sk);
 351
 352         if (sk->sk_state != BT_OPEN) {
 353                 err = -EBADFD;
 354                 goto done;
 355         }
 356
 357         if (sk->sk_type != SOCK_STREAM) {
 358                 err = -EINVAL;
 359                 goto done;
 360         }
 361
 362         write_lock(&rfcomm_sk_list.lock);
 363
 364         if (sa.rc_channel &&
 365             __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
 366                 err = -EADDRINUSE;
 367         } else {
 368                 /* Save source address */
 369                 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
 370                 rfcomm_pi(sk)->channel = sa.rc_channel;
 371                 sk->sk_state = BT_BOUND;
 372         }
 373
 374         write_unlock(&rfcomm_sk_list.lock);
 375
 376 done:
 377         release_sock(sk);
 378         return err;
 379 }
 380
 381 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 382 {
 383         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 384         struct sock *sk = sock->sk;
 385         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 386         int err = 0;
 387
 388         BT_DBG("sk %p", sk);
 389
 390         if (alen < sizeof(struct sockaddr_rc) ||
 391             addr->sa_family != AF_BLUETOOTH)
 392                 return -EINVAL;
 393
 394         lock_sock(sk);
 395
 396         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 397                 err = -EBADFD;
 398                 goto done;
 399         }
 400
 401         if (sk->sk_type != SOCK_STREAM) {
 402                 err = -EINVAL;
 403                 goto done;
 404         }
 405
 406         sk->sk_state = BT_CONNECT;
 407         bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
 408         rfcomm_pi(sk)->channel = sa->rc_channel;
 409
 410         d->sec_level = rfcomm_pi(sk)->sec_level;
 411         d->role_switch = rfcomm_pi(sk)->role_switch;
 412
 413         err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
 414                               sa->rc_channel);
 415         if (!err)
 416                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 417                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 418
 419 done:
 420         release_sock(sk);
 421         return err;
 422 }
 423
 424 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 425 {
 426         struct sock *sk = sock->sk;
 427         int err = 0;
 428
 429         BT_DBG("sk %p backlog %d", sk, backlog);
 430
 431         lock_sock(sk);
 432
 433         if (sk->sk_state != BT_BOUND) {
 434                 err = -EBADFD;
 435                 goto done;
 436         }
 437
 438         if (sk->sk_type != SOCK_STREAM) {
 439                 err = -EINVAL;
 440                 goto done;
 441         }
 442
 443         if (!rfcomm_pi(sk)->channel) {
 444                 bdaddr_t *src = &rfcomm_pi(sk)->src;
 445                 u8 channel;
 446
 447                 err = -EINVAL;
 448
 449                 write_lock(&rfcomm_sk_list.lock);
 450
 451                 for (channel = 1; channel < 31; channel++)
 452                         if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
 453                                 rfcomm_pi(sk)->channel = channel;
 454                                 err = 0;
 455                                 break;
 456                         }
 457
 458                 write_unlock(&rfcomm_sk_list.lock);
 459
 460                 if (err < 0)
 461                         goto done;
 462         }
 463
 464         sk->sk_max_ack_backlog = backlog;
 465         sk->sk_ack_backlog = 0;
 466         sk->sk_state = BT_LISTEN;
 467
 468 done:
 469         release_sock(sk);
 470         return err;
 471 }
 472
 473 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
 474                               bool kern)
 475 {
 476         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 477         struct sock *sk = sock->sk, *nsk;
 478         long timeo;
 479         int err = 0;
 480
 481         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 482
 483         if (sk->sk_type != SOCK_STREAM) {
 484                 err = -EINVAL;
 485                 goto done;
 486         }
 487
 488         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 489
 490         BT_DBG("sk %p timeo %ld", sk, timeo);
 491
 492         /* Wait for an incoming connection. (wake-one). */
 493         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 494         while (1) {
 495                 if (sk->sk_state != BT_LISTEN) {
 496                         err = -EBADFD;
 497                         break;
 498                 }
 499
 500                 nsk = bt_accept_dequeue(sk, newsock);
 501                 if (nsk)
 502                         break;
 503
 504                 if (!timeo) {
 505                         err = -EAGAIN;
 506                         break;
 507                 }
 508
 509                 if (signal_pending(current)) {
 510                         err = sock_intr_errno(timeo);
 511                         break;
 512                 }
 513
 514                 release_sock(sk);
 515
 516                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 517
 518                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 519         }
 520         remove_wait_queue(sk_sleep(sk), &wait);
 521
 522         if (err)
 523                 goto done;
 524
 525         newsock->state = SS_CONNECTED;
 526
 527         BT_DBG("new socket %p", nsk);
 528
 529 done:
 530         release_sock(sk);
 531         return err;
 532 }
 533
 534 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
 535 {
 536         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 537         struct sock *sk = sock->sk;
 538
 539         BT_DBG("sock %p, sk %p", sock, sk);
 540
 541         if (peer && sk->sk_state != BT_CONNECTED &&
 542             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
 543                 return -ENOTCONN;
 544
 545         memset(sa, 0, sizeof(*sa));
 546         sa->rc_family  = AF_BLUETOOTH;
 547         sa->rc_channel = rfcomm_pi(sk)->channel;
 548         if (peer)
 549                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
 550         else
 551                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 552
 553         return sizeof(struct sockaddr_rc);
 554 }
 555
 556 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 557                                size_t len)
 558 {
 559         struct sock *sk = sock->sk;
 560         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 561         struct sk_buff *skb;
 562         int sent;
 563
 564         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 565                 return -ENOTCONN;
 566
 567         if (msg->msg_flags & MSG_OOB)
 568                 return -EOPNOTSUPP;
 569
 570         if (sk->sk_shutdown & SEND_SHUTDOWN)
 571                 return -EPIPE;
 572
 573         BT_DBG("sock %p, sk %p", sock, sk);
 574
 575         lock_sock(sk);
 576
 577         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 578         if (sent)
 579                 goto done;
 580
 581         while (len) {
 582                 size_t size = min_t(size_t, len, d->mtu);
 583                 int err;
 584
 585                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 586                                 msg->msg_flags & MSG_DONTWAIT, &err);
 587                 if (!skb) {
 588                         if (sent == 0)
 589                                 sent = err;
 590                         break;
 591                 }
 592                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 593
 594                 err = memcpy_from_msg(skb_put(skb, size), msg, size);
 595                 if (err) {
 596                         kfree_skb(skb);
 597                         if (sent == 0)
 598                                 sent = err;
 599                         break;
 600                 }
 601
 602                 skb->priority = sk->sk_priority;
 603
 604                 err = rfcomm_dlc_send(d, skb);
 605                 if (err < 0) {
 606                         kfree_skb(skb);
 607                         if (sent == 0)
 608                                 sent = err;
 609                         break;
 610                 }
 611
 612                 sent += size;
 613                 len  -= size;
 614         }
 615
 616 done:
 617         release_sock(sk);
 618
 619         return sent;
 620 }
 621
 622 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 623                                size_t size, int flags)
 624 {
 625         struct sock *sk = sock->sk;
 626         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 627         int len;
 628
 629         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 630                 rfcomm_dlc_accept(d);
 631                 return 0;
 632         }
 633
 634         len = bt_sock_stream_recvmsg(sock, msg, size, flags);
 635
 636         lock_sock(sk);
 637         if (!(flags & MSG_PEEK) && len > 0)
 638                 atomic_sub(len, &sk->sk_rmem_alloc);
 639
 640         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 641                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 642         release_sock(sk);
 643
 644         return len;
 645 }
 646
 647 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname,
 648                 sockptr_t optval, unsigned int optlen)
 649 {
 650         struct sock *sk = sock->sk;
 651         int err = 0;
 652         u32 opt;
 653
 654         BT_DBG("sk %p", sk);
 655
 656         lock_sock(sk);
 657
 658         switch (optname) {
 659         case RFCOMM_LM:
 660                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 661                         err = -EFAULT;
 662                         break;
 663                 }
 664
 665                 if (opt & RFCOMM_LM_FIPS) {
 666                         err = -EINVAL;
 667                         break;
 668                 }
 669
 670                 if (opt & RFCOMM_LM_AUTH)
 671                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 672                 if (opt & RFCOMM_LM_ENCRYPT)
 673                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 674                 if (opt & RFCOMM_LM_SECURE)
 675                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 676
 677                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 678                 break;
 679
 680         default:
 681                 err = -ENOPROTOOPT;
 682                 break;
 683         }
 684
 685         release_sock(sk);
 686         return err;
 687 }
 688
 689 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
 690                 sockptr_t optval, unsigned int optlen)
 691 {
 692         struct sock *sk = sock->sk;
 693         struct bt_security sec;
 694         int err = 0;
 695         size_t len;
 696         u32 opt;
 697
 698         BT_DBG("sk %p", sk);
 699
 700         if (level == SOL_RFCOMM)
 701                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 702
 703         if (level != SOL_BLUETOOTH)
 704                 return -ENOPROTOOPT;
 705
 706         lock_sock(sk);
 707
 708         switch (optname) {
 709         case BT_SECURITY:
 710                 if (sk->sk_type != SOCK_STREAM) {
 711                         err = -EINVAL;
 712                         break;
 713                 }
 714
 715                 sec.level = BT_SECURITY_LOW;
 716
 717                 len = min_t(unsigned int, sizeof(sec), optlen);
 718                 if (copy_from_sockptr(&sec, optval, len)) {
 719                         err = -EFAULT;
 720                         break;
 721                 }
 722
 723                 if (sec.level > BT_SECURITY_HIGH) {
 724                         err = -EINVAL;
 725                         break;
 726                 }
 727
 728                 rfcomm_pi(sk)->sec_level = sec.level;
 729                 break;
 730
 731         case BT_DEFER_SETUP:
 732                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 733                         err = -EINVAL;
 734                         break;
 735                 }
 736
 737                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 738                         err = -EFAULT;
 739                         break;
 740                 }
 741
 742                 if (opt)
 743                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 744                 else
 745                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 746
 747                 break;
 748
 749         default:
 750                 err = -ENOPROTOOPT;
 751                 break;
 752         }
 753
 754         release_sock(sk);
 755         return err;
 756 }
 757
 758 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 759 {
 760         struct sock *sk = sock->sk;
 761         struct sock *l2cap_sk;
 762         struct l2cap_conn *conn;
 763         struct rfcomm_conninfo cinfo;
 764         int len, err = 0;
 765         u32 opt;
 766
 767         BT_DBG("sk %p", sk);
 768
 769         if (get_user(len, optlen))
 770                 return -EFAULT;
 771
 772         lock_sock(sk);
 773
 774         switch (optname) {
 775         case RFCOMM_LM:
 776                 switch (rfcomm_pi(sk)->sec_level) {
 777                 case BT_SECURITY_LOW:
 778                         opt = RFCOMM_LM_AUTH;
 779                         break;
 780                 case BT_SECURITY_MEDIUM:
 781                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 782                         break;
 783                 case BT_SECURITY_HIGH:
 784                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 785                               RFCOMM_LM_SECURE;
 786                         break;
 787                 case BT_SECURITY_FIPS:
 788                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 789                               RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
 790                         break;
 791                 default:
 792                         opt = 0;
 793                         break;
 794                 }
 795
 796                 if (rfcomm_pi(sk)->role_switch)
 797                         opt |= RFCOMM_LM_MASTER;
 798
 799                 if (put_user(opt, (u32 __user *) optval))
 800                         err = -EFAULT;
 801
 802                 break;
 803
 804         case RFCOMM_CONNINFO:
 805                 if (sk->sk_state != BT_CONNECTED &&
 806                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 807                         err = -ENOTCONN;
 808                         break;
 809                 }
 810
 811                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 812                 conn = l2cap_pi(l2cap_sk)->chan->conn;
 813
 814                 memset(&cinfo, 0, sizeof(cinfo));
 815                 cinfo.hci_handle = conn->hcon->handle;
 816                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 817
 818                 len = min_t(unsigned int, len, sizeof(cinfo));
 819                 if (copy_to_user(optval, (char *) &cinfo, len))
 820                         err = -EFAULT;
 821
 822                 break;
 823
 824         default:
 825                 err = -ENOPROTOOPT;
 826                 break;
 827         }
 828
 829         release_sock(sk);
 830         return err;
 831 }
 832
 833 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 834 {
 835         struct sock *sk = sock->sk;
 836         struct bt_security sec;
 837         int len, err = 0;
 838
 839         BT_DBG("sk %p", sk);
 840
 841         if (level == SOL_RFCOMM)
 842                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 843
 844         if (level != SOL_BLUETOOTH)
 845                 return -ENOPROTOOPT;
 846
 847         if (get_user(len, optlen))
 848                 return -EFAULT;
 849
 850         lock_sock(sk);
 851
 852         switch (optname) {
 853         case BT_SECURITY:
 854                 if (sk->sk_type != SOCK_STREAM) {
 855                         err = -EINVAL;
 856                         break;
 857                 }
 858
 859                 sec.level = rfcomm_pi(sk)->sec_level;
 860                 sec.key_size = 0;
 861
 862                 len = min_t(unsigned int, len, sizeof(sec));
 863                 if (copy_to_user(optval, (char *) &sec, len))
 864                         err = -EFAULT;
 865
 866                 break;
 867
 868         case BT_DEFER_SETUP:
 869                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 870                         err = -EINVAL;
 871                         break;
 872                 }
 873
 874                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 875                              (u32 __user *) optval))
 876                         err = -EFAULT;
 877
 878                 break;
 879
 880         default:
 881                 err = -ENOPROTOOPT;
 882                 break;
 883         }
 884
 885         release_sock(sk);
 886         return err;
 887 }
 888
 889 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 890 {
 891         struct sock *sk __maybe_unused = sock->sk;
 892         int err;
 893
 894         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 895
 896         err = bt_sock_ioctl(sock, cmd, arg);
 897
 898         if (err == -ENOIOCTLCMD) {
 899 #ifdef CONFIG_BT_RFCOMM_TTY
 900                 lock_sock(sk);
 901                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 902                 release_sock(sk);
 903 #else
 904                 err = -EOPNOTSUPP;
 905 #endif
 906         }
 907
 908         return err;
 909 }
 910
 911 #ifdef CONFIG_COMPAT
 912 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 913 {
 914         return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
 915 }
 916 #endif
 917
 918 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 919 {
 920         struct sock *sk = sock->sk;
 921         int err = 0;
 922
 923         BT_DBG("sock %p, sk %p", sock, sk);
 924
 925         if (!sk)
 926                 return 0;
 927
 928         lock_sock(sk);
 929         if (!sk->sk_shutdown) {
 930                 sk->sk_shutdown = SHUTDOWN_MASK;
 931                 __rfcomm_sock_close(sk);
 932
 933                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
 934                     !(current->flags & PF_EXITING))
 935                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 936         }
 937         release_sock(sk);
 938         return err;
 939 }
 940
 941 static int rfcomm_sock_release(struct socket *sock)
 942 {
 943         struct sock *sk = sock->sk;
 944         int err;
 945
 946         BT_DBG("sock %p, sk %p", sock, sk);
 947
 948         if (!sk)
 949                 return 0;
 950
 951         err = rfcomm_sock_shutdown(sock, 2);
 952
 953         sock_orphan(sk);
 954         rfcomm_sock_kill(sk);
 955         return err;
 956 }
 957
 958 /* ---- RFCOMM core layer callbacks ----
 959  *
 960  * called under rfcomm_lock()
 961  */
 962 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 963 {
 964         struct sock *sk, *parent;
 965         bdaddr_t src, dst;
 966         int result = 0;
 967
 968         BT_DBG("session %p channel %d", s, channel);
 969
 970         rfcomm_session_getaddr(s, &src, &dst);
 971
 972         /* Check if we have socket listening on channel */
 973         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 974         if (!parent)
 975                 return 0;
 976
 977         lock_sock(parent);
 978
 979         /* Check for backlog size */
 980         if (sk_acceptq_is_full(parent)) {
 981                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 982                 goto done;
 983         }
 984
 985         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
 986         if (!sk)
 987                 goto done;
 988
 989         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 990
 991         rfcomm_sock_init(sk, parent);
 992         bacpy(&rfcomm_pi(sk)->src, &src);
 993         bacpy(&rfcomm_pi(sk)->dst, &dst);
 994         rfcomm_pi(sk)->channel = channel;
 995
 996         sk->sk_state = BT_CONFIG;
 997         bt_accept_enqueue(parent, sk, true);
 998
 999         /* Accept connection and return socket DLC */
1000         *d = rfcomm_pi(sk)->dlc;
1001         result = 1;
1002
1003 done:
1004         release_sock(parent);
1005
1006         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1007                 parent->sk_state_change(parent);
1008
1009         return result;
1010 }
1011
1012 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1013 {
1014         struct sock *sk;
1015
1016         read_lock(&rfcomm_sk_list.lock);
1017
1018         sk_for_each(sk, &rfcomm_sk_list.head) {
1019                 seq_printf(f, "%pMR %pMR %d %d\n",
1020                            &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1021                            sk->sk_state, rfcomm_pi(sk)->channel);
1022         }
1023
1024         read_unlock(&rfcomm_sk_list.lock);
1025
1026         return 0;
1027 }
1028
1029 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs);
1030
1031 static struct dentry *rfcomm_sock_debugfs;
1032
1033 static const struct proto_ops rfcomm_sock_ops = {
1034         .family         = PF_BLUETOOTH,
1035         .owner          = THIS_MODULE,
1036         .release        = rfcomm_sock_release,
1037         .bind           = rfcomm_sock_bind,
1038         .connect        = rfcomm_sock_connect,
1039         .listen         = rfcomm_sock_listen,
1040         .accept         = rfcomm_sock_accept,
1041         .getname        = rfcomm_sock_getname,
1042         .sendmsg        = rfcomm_sock_sendmsg,
1043         .recvmsg        = rfcomm_sock_recvmsg,
1044         .shutdown       = rfcomm_sock_shutdown,
1045         .setsockopt     = rfcomm_sock_setsockopt,
1046         .getsockopt     = rfcomm_sock_getsockopt,
1047         .ioctl          = rfcomm_sock_ioctl,
1048         .gettstamp      = sock_gettstamp,
1049         .poll           = bt_sock_poll,
1050         .socketpair     = sock_no_socketpair,
1051         .mmap           = sock_no_mmap,
1052 #ifdef CONFIG_COMPAT
1053         .compat_ioctl   = rfcomm_sock_compat_ioctl,
1054 #endif
1055 };
1056
1057 static const struct net_proto_family rfcomm_sock_family_ops = {
1058         .family         = PF_BLUETOOTH,
1059         .owner          = THIS_MODULE,
1060         .create         = rfcomm_sock_create
1061 };
1062
1063 int __init rfcomm_init_sockets(void)
1064 {
1065         int err;
1066
1067         BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1068
1069         err = proto_register(&rfcomm_proto, 0);
1070         if (err < 0)
1071                 return err;
1072
1073         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1074         if (err < 0) {
1075                 BT_ERR("RFCOMM socket layer registration failed");
1076                 goto error;
1077         }
1078
1079         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1080         if (err < 0) {
1081                 BT_ERR("Failed to create RFCOMM proc file");
1082                 bt_sock_unregister(BTPROTO_RFCOMM);
1083                 goto error;
1084         }
1085
1086         BT_INFO("RFCOMM socket layer initialized");
1087
1088         if (IS_ERR_OR_NULL(bt_debugfs))
1089                 return 0;
1090
1091         rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1092                                                   bt_debugfs, NULL,
1093                                                   &rfcomm_sock_debugfs_fops);
1094
1095         return 0;
1096
1097 error:
1098         proto_unregister(&rfcomm_proto);
1099         return err;
1100 }
1101
1102 void __exit rfcomm_cleanup_sockets(void)
1103 {
1104         bt_procfs_cleanup(&init_net, "rfcomm");
1105
1106         debugfs_remove(rfcomm_sock_debugfs);
1107
1108         bt_sock_unregister(BTPROTO_RFCOMM);
1109
1110         proto_unregister(&rfcomm_proto);
1111 }