Bluetooth: RFCOMM - Fix info leak via getsockname()
[pandora-kernel.git] / net / bluetooth / af_bluetooth.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth address family and sockets. */
26
27 #include <linux/module.h>
28
29 #include <linux/types.h>
30 #include <linux/list.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/skbuff.h>
35 #include <linux/init.h>
36 #include <linux/poll.h>
37 #include <net/sock.h>
38 #include <asm/ioctls.h>
39 #include <linux/kmod.h>
40
41 #include <net/bluetooth/bluetooth.h>
42
43 #define VERSION "2.16"
44
45 /* Bluetooth sockets */
46 #define BT_MAX_PROTO    8
47 static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
48 static DEFINE_RWLOCK(bt_proto_lock);
49
50 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
51 static const char *const bt_key_strings[BT_MAX_PROTO] = {
52         "sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP",
53         "sk_lock-AF_BLUETOOTH-BTPROTO_HCI",
54         "sk_lock-AF_BLUETOOTH-BTPROTO_SCO",
55         "sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM",
56         "sk_lock-AF_BLUETOOTH-BTPROTO_BNEP",
57         "sk_lock-AF_BLUETOOTH-BTPROTO_CMTP",
58         "sk_lock-AF_BLUETOOTH-BTPROTO_HIDP",
59         "sk_lock-AF_BLUETOOTH-BTPROTO_AVDTP",
60 };
61
62 static struct lock_class_key bt_slock_key[BT_MAX_PROTO];
63 static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
64         "slock-AF_BLUETOOTH-BTPROTO_L2CAP",
65         "slock-AF_BLUETOOTH-BTPROTO_HCI",
66         "slock-AF_BLUETOOTH-BTPROTO_SCO",
67         "slock-AF_BLUETOOTH-BTPROTO_RFCOMM",
68         "slock-AF_BLUETOOTH-BTPROTO_BNEP",
69         "slock-AF_BLUETOOTH-BTPROTO_CMTP",
70         "slock-AF_BLUETOOTH-BTPROTO_HIDP",
71         "slock-AF_BLUETOOTH-BTPROTO_AVDTP",
72 };
73
74 static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
75 {
76         struct sock *sk = sock->sk;
77
78         if (!sk)
79                 return;
80
81         BUG_ON(sock_owned_by_user(sk));
82
83         sock_lock_init_class_and_name(sk,
84                         bt_slock_key_strings[proto], &bt_slock_key[proto],
85                                 bt_key_strings[proto], &bt_lock_key[proto]);
86 }
87
88 int bt_sock_register(int proto, const struct net_proto_family *ops)
89 {
90         int err = 0;
91
92         if (proto < 0 || proto >= BT_MAX_PROTO)
93                 return -EINVAL;
94
95         write_lock(&bt_proto_lock);
96
97         if (bt_proto[proto])
98                 err = -EEXIST;
99         else
100                 bt_proto[proto] = ops;
101
102         write_unlock(&bt_proto_lock);
103
104         return err;
105 }
106 EXPORT_SYMBOL(bt_sock_register);
107
108 int bt_sock_unregister(int proto)
109 {
110         int err = 0;
111
112         if (proto < 0 || proto >= BT_MAX_PROTO)
113                 return -EINVAL;
114
115         write_lock(&bt_proto_lock);
116
117         if (!bt_proto[proto])
118                 err = -ENOENT;
119         else
120                 bt_proto[proto] = NULL;
121
122         write_unlock(&bt_proto_lock);
123
124         return err;
125 }
126 EXPORT_SYMBOL(bt_sock_unregister);
127
128 static int bt_sock_create(struct net *net, struct socket *sock, int proto,
129                           int kern)
130 {
131         int err;
132
133         if (net != &init_net)
134                 return -EAFNOSUPPORT;
135
136         if (proto < 0 || proto >= BT_MAX_PROTO)
137                 return -EINVAL;
138
139         if (!bt_proto[proto])
140                 request_module("bt-proto-%d", proto);
141
142         err = -EPROTONOSUPPORT;
143
144         read_lock(&bt_proto_lock);
145
146         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
147                 err = bt_proto[proto]->create(net, sock, proto, kern);
148                 bt_sock_reclassify_lock(sock, proto);
149                 module_put(bt_proto[proto]->owner);
150         }
151
152         read_unlock(&bt_proto_lock);
153
154         return err;
155 }
156
157 void bt_sock_link(struct bt_sock_list *l, struct sock *sk)
158 {
159         write_lock_bh(&l->lock);
160         sk_add_node(sk, &l->head);
161         write_unlock_bh(&l->lock);
162 }
163 EXPORT_SYMBOL(bt_sock_link);
164
165 void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
166 {
167         write_lock_bh(&l->lock);
168         sk_del_node_init(sk);
169         write_unlock_bh(&l->lock);
170 }
171 EXPORT_SYMBOL(bt_sock_unlink);
172
173 void bt_accept_enqueue(struct sock *parent, struct sock *sk)
174 {
175         BT_DBG("parent %p, sk %p", parent, sk);
176
177         sock_hold(sk);
178         list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
179         bt_sk(sk)->parent = parent;
180         parent->sk_ack_backlog++;
181 }
182 EXPORT_SYMBOL(bt_accept_enqueue);
183
184 void bt_accept_unlink(struct sock *sk)
185 {
186         BT_DBG("sk %p state %d", sk, sk->sk_state);
187
188         list_del_init(&bt_sk(sk)->accept_q);
189         bt_sk(sk)->parent->sk_ack_backlog--;
190         bt_sk(sk)->parent = NULL;
191         sock_put(sk);
192 }
193 EXPORT_SYMBOL(bt_accept_unlink);
194
195 struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
196 {
197         struct list_head *p, *n;
198         struct sock *sk;
199
200         BT_DBG("parent %p", parent);
201
202         local_bh_disable();
203         list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
204                 sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
205
206                 bh_lock_sock(sk);
207
208                 /* FIXME: Is this check still needed */
209                 if (sk->sk_state == BT_CLOSED) {
210                         bh_unlock_sock(sk);
211                         bt_accept_unlink(sk);
212                         continue;
213                 }
214
215                 if (sk->sk_state == BT_CONNECTED || !newsock ||
216                                                 bt_sk(parent)->defer_setup) {
217                         bt_accept_unlink(sk);
218                         if (newsock)
219                                 sock_graft(sk, newsock);
220
221                         bh_unlock_sock(sk);
222                         local_bh_enable();
223                         return sk;
224                 }
225
226                 bh_unlock_sock(sk);
227         }
228         local_bh_enable();
229
230         return NULL;
231 }
232 EXPORT_SYMBOL(bt_accept_dequeue);
233
234 int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
235                                 struct msghdr *msg, size_t len, int flags)
236 {
237         int noblock = flags & MSG_DONTWAIT;
238         struct sock *sk = sock->sk;
239         struct sk_buff *skb;
240         size_t copied;
241         int err;
242
243         BT_DBG("sock %p sk %p len %zu", sock, sk, len);
244
245         if (flags & (MSG_OOB))
246                 return -EOPNOTSUPP;
247
248         skb = skb_recv_datagram(sk, flags, noblock, &err);
249         if (!skb) {
250                 if (sk->sk_shutdown & RCV_SHUTDOWN)
251                         return 0;
252                 return err;
253         }
254
255         msg->msg_namelen = 0;
256
257         copied = skb->len;
258         if (len < copied) {
259                 msg->msg_flags |= MSG_TRUNC;
260                 copied = len;
261         }
262
263         skb_reset_transport_header(skb);
264         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
265         if (err == 0)
266                 sock_recv_ts_and_drops(msg, sk, skb);
267
268         skb_free_datagram(sk, skb);
269
270         return err ? : copied;
271 }
272 EXPORT_SYMBOL(bt_sock_recvmsg);
273
274 static long bt_sock_data_wait(struct sock *sk, long timeo)
275 {
276         DECLARE_WAITQUEUE(wait, current);
277
278         add_wait_queue(sk_sleep(sk), &wait);
279         for (;;) {
280                 set_current_state(TASK_INTERRUPTIBLE);
281
282                 if (!skb_queue_empty(&sk->sk_receive_queue))
283                         break;
284
285                 if (sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN))
286                         break;
287
288                 if (signal_pending(current) || !timeo)
289                         break;
290
291                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
292                 release_sock(sk);
293                 timeo = schedule_timeout(timeo);
294                 lock_sock(sk);
295                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
296         }
297
298         __set_current_state(TASK_RUNNING);
299         remove_wait_queue(sk_sleep(sk), &wait);
300         return timeo;
301 }
302
303 int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
304                                struct msghdr *msg, size_t size, int flags)
305 {
306         struct sock *sk = sock->sk;
307         int err = 0;
308         size_t target, copied = 0;
309         long timeo;
310
311         if (flags & MSG_OOB)
312                 return -EOPNOTSUPP;
313
314         msg->msg_namelen = 0;
315
316         BT_DBG("sk %p size %zu", sk, size);
317
318         lock_sock(sk);
319
320         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
321         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
322
323         do {
324                 struct sk_buff *skb;
325                 int chunk;
326
327                 skb = skb_dequeue(&sk->sk_receive_queue);
328                 if (!skb) {
329                         if (copied >= target)
330                                 break;
331
332                         err = sock_error(sk);
333                         if (err)
334                                 break;
335                         if (sk->sk_shutdown & RCV_SHUTDOWN)
336                                 break;
337
338                         err = -EAGAIN;
339                         if (!timeo)
340                                 break;
341
342                         timeo = bt_sock_data_wait(sk, timeo);
343
344                         if (signal_pending(current)) {
345                                 err = sock_intr_errno(timeo);
346                                 goto out;
347                         }
348                         continue;
349                 }
350
351                 chunk = min_t(unsigned int, skb->len, size);
352                 if (skb_copy_datagram_iovec(skb, 0, msg->msg_iov, chunk)) {
353                         skb_queue_head(&sk->sk_receive_queue, skb);
354                         if (!copied)
355                                 copied = -EFAULT;
356                         break;
357                 }
358                 copied += chunk;
359                 size   -= chunk;
360
361                 sock_recv_ts_and_drops(msg, sk, skb);
362
363                 if (!(flags & MSG_PEEK)) {
364                         int skb_len = skb_headlen(skb);
365
366                         if (chunk <= skb_len) {
367                                 __skb_pull(skb, chunk);
368                         } else {
369                                 struct sk_buff *frag;
370
371                                 __skb_pull(skb, skb_len);
372                                 chunk -= skb_len;
373
374                                 skb_walk_frags(skb, frag) {
375                                         if (chunk <= frag->len) {
376                                                 /* Pulling partial data */
377                                                 skb->len -= chunk;
378                                                 skb->data_len -= chunk;
379                                                 __skb_pull(frag, chunk);
380                                                 break;
381                                         } else if (frag->len) {
382                                                 /* Pulling all frag data */
383                                                 chunk -= frag->len;
384                                                 skb->len -= frag->len;
385                                                 skb->data_len -= frag->len;
386                                                 __skb_pull(frag, frag->len);
387                                         }
388                                 }
389                         }
390
391                         if (skb->len) {
392                                 skb_queue_head(&sk->sk_receive_queue, skb);
393                                 break;
394                         }
395                         kfree_skb(skb);
396
397                 } else {
398                         /* put message back and return */
399                         skb_queue_head(&sk->sk_receive_queue, skb);
400                         break;
401                 }
402         } while (size);
403
404 out:
405         release_sock(sk);
406         return copied ? : err;
407 }
408 EXPORT_SYMBOL(bt_sock_stream_recvmsg);
409
410 static inline unsigned int bt_accept_poll(struct sock *parent)
411 {
412         struct list_head *p, *n;
413         struct sock *sk;
414
415         list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
416                 sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
417                 if (sk->sk_state == BT_CONNECTED ||
418                                         (bt_sk(parent)->defer_setup &&
419                                                 sk->sk_state == BT_CONNECT2))
420                         return POLLIN | POLLRDNORM;
421         }
422
423         return 0;
424 }
425
426 unsigned int bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait)
427 {
428         struct sock *sk = sock->sk;
429         unsigned int mask = 0;
430
431         BT_DBG("sock %p, sk %p", sock, sk);
432
433         poll_wait(file, sk_sleep(sk), wait);
434
435         if (sk->sk_state == BT_LISTEN)
436                 return bt_accept_poll(sk);
437
438         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
439                 mask |= POLLERR;
440
441         if (sk->sk_shutdown & RCV_SHUTDOWN)
442                 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
443
444         if (sk->sk_shutdown == SHUTDOWN_MASK)
445                 mask |= POLLHUP;
446
447         if (!skb_queue_empty(&sk->sk_receive_queue))
448                 mask |= POLLIN | POLLRDNORM;
449
450         if (sk->sk_state == BT_CLOSED)
451                 mask |= POLLHUP;
452
453         if (sk->sk_state == BT_CONNECT ||
454                         sk->sk_state == BT_CONNECT2 ||
455                         sk->sk_state == BT_CONFIG)
456                 return mask;
457
458         if (sock_writeable(sk))
459                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
460         else
461                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
462
463         return mask;
464 }
465 EXPORT_SYMBOL(bt_sock_poll);
466
467 int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
468 {
469         struct sock *sk = sock->sk;
470         struct sk_buff *skb;
471         long amount;
472         int err;
473
474         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
475
476         switch (cmd) {
477         case TIOCOUTQ:
478                 if (sk->sk_state == BT_LISTEN)
479                         return -EINVAL;
480
481                 amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
482                 if (amount < 0)
483                         amount = 0;
484                 err = put_user(amount, (int __user *) arg);
485                 break;
486
487         case TIOCINQ:
488                 if (sk->sk_state == BT_LISTEN)
489                         return -EINVAL;
490
491                 lock_sock(sk);
492                 skb = skb_peek(&sk->sk_receive_queue);
493                 amount = skb ? skb->len : 0;
494                 release_sock(sk);
495                 err = put_user(amount, (int __user *) arg);
496                 break;
497
498         case SIOCGSTAMP:
499                 err = sock_get_timestamp(sk, (struct timeval __user *) arg);
500                 break;
501
502         case SIOCGSTAMPNS:
503                 err = sock_get_timestampns(sk, (struct timespec __user *) arg);
504                 break;
505
506         default:
507                 err = -ENOIOCTLCMD;
508                 break;
509         }
510
511         return err;
512 }
513 EXPORT_SYMBOL(bt_sock_ioctl);
514
515 int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
516 {
517         DECLARE_WAITQUEUE(wait, current);
518         int err = 0;
519
520         BT_DBG("sk %p", sk);
521
522         add_wait_queue(sk_sleep(sk), &wait);
523         set_current_state(TASK_INTERRUPTIBLE);
524         while (sk->sk_state != state) {
525                 if (!timeo) {
526                         err = -EINPROGRESS;
527                         break;
528                 }
529
530                 if (signal_pending(current)) {
531                         err = sock_intr_errno(timeo);
532                         break;
533                 }
534
535                 release_sock(sk);
536                 timeo = schedule_timeout(timeo);
537                 lock_sock(sk);
538                 set_current_state(TASK_INTERRUPTIBLE);
539
540                 err = sock_error(sk);
541                 if (err)
542                         break;
543         }
544         __set_current_state(TASK_RUNNING);
545         remove_wait_queue(sk_sleep(sk), &wait);
546         return err;
547 }
548 EXPORT_SYMBOL(bt_sock_wait_state);
549
550 static struct net_proto_family bt_sock_family_ops = {
551         .owner  = THIS_MODULE,
552         .family = PF_BLUETOOTH,
553         .create = bt_sock_create,
554 };
555
556 static int __init bt_init(void)
557 {
558         int err;
559
560         BT_INFO("Core ver %s", VERSION);
561
562         err = bt_sysfs_init();
563         if (err < 0)
564                 return err;
565
566         err = sock_register(&bt_sock_family_ops);
567         if (err < 0) {
568                 bt_sysfs_cleanup();
569                 return err;
570         }
571
572         BT_INFO("HCI device and connection manager initialized");
573
574         err = hci_sock_init();
575         if (err < 0)
576                 goto error;
577
578         err = l2cap_init();
579         if (err < 0)
580                 goto sock_err;
581
582         err = sco_init();
583         if (err < 0) {
584                 l2cap_exit();
585                 goto sock_err;
586         }
587
588         return 0;
589
590 sock_err:
591         hci_sock_cleanup();
592
593 error:
594         sock_unregister(PF_BLUETOOTH);
595         bt_sysfs_cleanup();
596
597         return err;
598 }
599
600 static void __exit bt_exit(void)
601 {
602
603         sco_exit();
604
605         l2cap_exit();
606
607         hci_sock_cleanup();
608
609         sock_unregister(PF_BLUETOOTH);
610
611         bt_sysfs_cleanup();
612 }
613
614 subsys_initcall(bt_init);
615 module_exit(bt_exit);
616
617 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
618 MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
619 MODULE_VERSION(VERSION);
620 MODULE_LICENSE("GPL");
621 MODULE_ALIAS_NETPROTO(PF_BLUETOOTH);