net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/types.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <linux/debugfs.h>
  44 #include <linux/seq_file.h>
  45 #include <linux/security.h>
  46 #include <net/sock.h>
  47
  48 #include <asm/system.h>
  49 #include <linux/uaccess.h>
  50
  51 #include <net/bluetooth/bluetooth.h>
  52 #include <net/bluetooth/hci_core.h>
  53 #include <net/bluetooth/l2cap.h>
  54 #include <net/bluetooth/rfcomm.h>
  55
  56 static const struct proto_ops rfcomm_sock_ops;
  57
  58 static struct bt_sock_list rfcomm_sk_list = {
  59         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  60 };
  61
  62 static void rfcomm_sock_close(struct sock *sk);
  63 static void rfcomm_sock_kill(struct sock *sk);
  64
  65 /* ---- DLC callbacks ----
  66  *
  67  * called under rfcomm_dlc_lock()
  68  */
  69 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  70 {
  71         struct sock *sk = d->owner;
  72         if (!sk)
  73                 return;
  74
  75         atomic_add(skb->len, &sk->sk_rmem_alloc);
  76         skb_queue_tail(&sk->sk_receive_queue, skb);
  77         sk->sk_data_ready(sk, skb->len);
  78
  79         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  80                 rfcomm_dlc_throttle(d);
  81 }
  82
  83 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  84 {
  85         struct sock *sk = d->owner, *parent;
  86         unsigned long flags;
  87
  88         if (!sk)
  89                 return;
  90
  91         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  92
  93         local_irq_save(flags);
  94         bh_lock_sock(sk);
  95
  96         if (err)
  97                 sk->sk_err = err;
  98
  99         sk->sk_state = d->state;
 100
 101         parent = bt_sk(sk)->parent;
 102         if (parent) {
 103                 if (d->state == BT_CLOSED) {
 104                         sock_set_flag(sk, SOCK_ZAPPED);
 105                         bt_accept_unlink(sk);
 106                 }
 107                 parent->sk_data_ready(parent, 0);
 108         } else {
 109                 if (d->state == BT_CONNECTED)
 110                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 111                 sk->sk_state_change(sk);
 112         }
 113
 114         bh_unlock_sock(sk);
 115         local_irq_restore(flags);
 116
 117         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
 118                 /* We have to drop DLC lock here, otherwise
 119                  * rfcomm_sock_destruct() will dead lock. */
 120                 rfcomm_dlc_unlock(d);
 121                 rfcomm_sock_kill(sk);
 122                 rfcomm_dlc_lock(d);
 123         }
 124 }
 125
 126 /* ---- Socket functions ---- */
 127 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 128 {
 129         struct sock *sk = NULL;
 130         struct hlist_node *node;
 131
 132         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 133                 if (rfcomm_pi(sk)->channel == channel &&
 134                                 !bacmp(&bt_sk(sk)->src, src))
 135                         break;
 136         }
 137
 138         return node ? sk : NULL;
 139 }
 140
 141 /* Find socket with channel and source bdaddr.
 142  * Returns closest match.
 143  */
 144 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 145 {
 146         struct sock *sk = NULL, *sk1 = NULL;
 147         struct hlist_node *node;
 148
 149         read_lock(&rfcomm_sk_list.lock);
 150
 151         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 152                 if (state && sk->sk_state != state)
 153                         continue;
 154
 155                 if (rfcomm_pi(sk)->channel == channel) {
 156                         /* Exact match. */
 157                         if (!bacmp(&bt_sk(sk)->src, src))
 158                                 break;
 159
 160                         /* Closest match */
 161                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 162                                 sk1 = sk;
 163                 }
 164         }
 165
 166         read_unlock(&rfcomm_sk_list.lock);
 167
 168         return node ? sk : sk1;
 169 }
 170
 171 static void rfcomm_sock_destruct(struct sock *sk)
 172 {
 173         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 174
 175         BT_DBG("sk %p dlc %p", sk, d);
 176
 177         skb_queue_purge(&sk->sk_receive_queue);
 178         skb_queue_purge(&sk->sk_write_queue);
 179
 180         rfcomm_dlc_lock(d);
 181         rfcomm_pi(sk)->dlc = NULL;
 182
 183         /* Detach DLC if it's owned by this socket */
 184         if (d->owner == sk)
 185                 d->owner = NULL;
 186         rfcomm_dlc_unlock(d);
 187
 188         rfcomm_dlc_put(d);
 189 }
 190
 191 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 192 {
 193         struct sock *sk;
 194
 195         BT_DBG("parent %p", parent);
 196
 197         /* Close not yet accepted dlcs */
 198         while ((sk = bt_accept_dequeue(parent, NULL))) {
 199                 rfcomm_sock_close(sk);
 200                 rfcomm_sock_kill(sk);
 201         }
 202
 203         parent->sk_state  = BT_CLOSED;
 204         sock_set_flag(parent, SOCK_ZAPPED);
 205 }
 206
 207 /* Kill socket (only if zapped and orphan)
 208  * Must be called on unlocked socket.
 209  */
 210 static void rfcomm_sock_kill(struct sock *sk)
 211 {
 212         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 213                 return;
 214
 215         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 216
 217         /* Kill poor orphan */
 218         bt_sock_unlink(&rfcomm_sk_list, sk);
 219         sock_set_flag(sk, SOCK_DEAD);
 220         sock_put(sk);
 221 }
 222
 223 static void __rfcomm_sock_close(struct sock *sk)
 224 {
 225         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 226
 227         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 228
 229         switch (sk->sk_state) {
 230         case BT_LISTEN:
 231                 rfcomm_sock_cleanup_listen(sk);
 232                 break;
 233
 234         case BT_CONNECT:
 235         case BT_CONNECT2:
 236         case BT_CONFIG:
 237         case BT_CONNECTED:
 238                 rfcomm_dlc_close(d, 0);
 239
 240         default:
 241                 sock_set_flag(sk, SOCK_ZAPPED);
 242                 break;
 243         }
 244 }
 245
 246 /* Close socket.
 247  * Must be called on unlocked socket.
 248  */
 249 static void rfcomm_sock_close(struct sock *sk)
 250 {
 251         lock_sock(sk);
 252         __rfcomm_sock_close(sk);
 253         release_sock(sk);
 254 }
 255
 256 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 257 {
 258         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 259
 260         BT_DBG("sk %p", sk);
 261
 262         if (parent) {
 263                 sk->sk_type = parent->sk_type;
 264                 pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
 265
 266                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 267                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 268
 269                 security_sk_clone(parent, sk);
 270         } else {
 271                 pi->dlc->defer_setup = 0;
 272
 273                 pi->sec_level = BT_SECURITY_LOW;
 274                 pi->role_switch = 0;
 275         }
 276
 277         pi->dlc->sec_level = pi->sec_level;
 278         pi->dlc->role_switch = pi->role_switch;
 279 }
 280
 281 static struct proto rfcomm_proto = {
 282         .name           = "RFCOMM",
 283         .owner          = THIS_MODULE,
 284         .obj_size       = sizeof(struct rfcomm_pinfo)
 285 };
 286
 287 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 288 {
 289         struct rfcomm_dlc *d;
 290         struct sock *sk;
 291
 292         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 293         if (!sk)
 294                 return NULL;
 295
 296         sock_init_data(sock, sk);
 297         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 298
 299         d = rfcomm_dlc_alloc(prio);
 300         if (!d) {
 301                 sk_free(sk);
 302                 return NULL;
 303         }
 304
 305         d->data_ready   = rfcomm_sk_data_ready;
 306         d->state_change = rfcomm_sk_state_change;
 307
 308         rfcomm_pi(sk)->dlc = d;
 309         d->owner = sk;
 310
 311         sk->sk_destruct = rfcomm_sock_destruct;
 312         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 313
 314         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 315         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 316
 317         sock_reset_flag(sk, SOCK_ZAPPED);
 318
 319         sk->sk_protocol = proto;
 320         sk->sk_state    = BT_OPEN;
 321
 322         bt_sock_link(&rfcomm_sk_list, sk);
 323
 324         BT_DBG("sk %p", sk);
 325         return sk;
 326 }
 327
 328 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 329                               int protocol, int kern)
 330 {
 331         struct sock *sk;
 332
 333         BT_DBG("sock %p", sock);
 334
 335         sock->state = SS_UNCONNECTED;
 336
 337         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 338                 return -ESOCKTNOSUPPORT;
 339
 340         sock->ops = &rfcomm_sock_ops;
 341
 342         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 343         if (!sk)
 344                 return -ENOMEM;
 345
 346         rfcomm_sock_init(sk, NULL);
 347         return 0;
 348 }
 349
 350 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 351 {
 352         struct sockaddr_rc sa;
 353         struct sock *sk = sock->sk;
 354         int len, err = 0;
 355
 356         if (!addr || addr->sa_family != AF_BLUETOOTH)
 357                 return -EINVAL;
 358
 359         memset(&sa, 0, sizeof(sa));
 360         len = min_t(unsigned int, sizeof(sa), addr_len);
 361         memcpy(&sa, addr, len);
 362
 363         BT_DBG("sk %p %s", sk, batostr(&sa.rc_bdaddr));
 364
 365         lock_sock(sk);
 366
 367         if (sk->sk_state != BT_OPEN) {
 368                 err = -EBADFD;
 369                 goto done;
 370         }
 371
 372         if (sk->sk_type != SOCK_STREAM) {
 373                 err = -EINVAL;
 374                 goto done;
 375         }
 376
 377         write_lock_bh(&rfcomm_sk_list.lock);
 378
 379         if (sa.rc_channel &&
 380             __rfcomm_get_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
 381                 err = -EADDRINUSE;
 382         } else {
 383                 /* Save source address */
 384                 bacpy(&bt_sk(sk)->src, &sa.rc_bdaddr);
 385                 rfcomm_pi(sk)->channel = sa.rc_channel;
 386                 sk->sk_state = BT_BOUND;
 387         }
 388
 389         write_unlock_bh(&rfcomm_sk_list.lock);
 390
 391 done:
 392         release_sock(sk);
 393         return err;
 394 }
 395
 396 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 397 {
 398         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 399         struct sock *sk = sock->sk;
 400         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 401         int err = 0;
 402
 403         BT_DBG("sk %p", sk);
 404
 405         if (alen < sizeof(struct sockaddr_rc) ||
 406             addr->sa_family != AF_BLUETOOTH)
 407                 return -EINVAL;
 408
 409         lock_sock(sk);
 410
 411         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 412                 err = -EBADFD;
 413                 goto done;
 414         }
 415
 416         if (sk->sk_type != SOCK_STREAM) {
 417                 err = -EINVAL;
 418                 goto done;
 419         }
 420
 421         sk->sk_state = BT_CONNECT;
 422         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 423         rfcomm_pi(sk)->channel = sa->rc_channel;
 424
 425         d->sec_level = rfcomm_pi(sk)->sec_level;
 426         d->role_switch = rfcomm_pi(sk)->role_switch;
 427
 428         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 429         if (!err)
 430                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 431                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 432
 433 done:
 434         release_sock(sk);
 435         return err;
 436 }
 437
 438 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 439 {
 440         struct sock *sk = sock->sk;
 441         int err = 0;
 442
 443         BT_DBG("sk %p backlog %d", sk, backlog);
 444
 445         lock_sock(sk);
 446
 447         if (sk->sk_state != BT_BOUND) {
 448                 err = -EBADFD;
 449                 goto done;
 450         }
 451
 452         if (sk->sk_type != SOCK_STREAM) {
 453                 err = -EINVAL;
 454                 goto done;
 455         }
 456
 457         if (!rfcomm_pi(sk)->channel) {
 458                 bdaddr_t *src = &bt_sk(sk)->src;
 459                 u8 channel;
 460
 461                 err = -EINVAL;
 462
 463                 write_lock_bh(&rfcomm_sk_list.lock);
 464
 465                 for (channel = 1; channel < 31; channel++)
 466                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 467                                 rfcomm_pi(sk)->channel = channel;
 468                                 err = 0;
 469                                 break;
 470                         }
 471
 472                 write_unlock_bh(&rfcomm_sk_list.lock);
 473
 474                 if (err < 0)
 475                         goto done;
 476         }
 477
 478         sk->sk_max_ack_backlog = backlog;
 479         sk->sk_ack_backlog = 0;
 480         sk->sk_state = BT_LISTEN;
 481
 482 done:
 483         release_sock(sk);
 484         return err;
 485 }
 486
 487 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 488 {
 489         DECLARE_WAITQUEUE(wait, current);
 490         struct sock *sk = sock->sk, *nsk;
 491         long timeo;
 492         int err = 0;
 493
 494         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 495
 496         if (sk->sk_type != SOCK_STREAM) {
 497                 err = -EINVAL;
 498                 goto done;
 499         }
 500
 501         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 502
 503         BT_DBG("sk %p timeo %ld", sk, timeo);
 504
 505         /* Wait for an incoming connection. (wake-one). */
 506         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 507         while (1) {
 508                 set_current_state(TASK_INTERRUPTIBLE);
 509
 510                 if (sk->sk_state != BT_LISTEN) {
 511                         err = -EBADFD;
 512                         break;
 513                 }
 514
 515                 nsk = bt_accept_dequeue(sk, newsock);
 516                 if (nsk)
 517                         break;
 518
 519                 if (!timeo) {
 520                         err = -EAGAIN;
 521                         break;
 522                 }
 523
 524                 if (signal_pending(current)) {
 525                         err = sock_intr_errno(timeo);
 526                         break;
 527                 }
 528
 529                 release_sock(sk);
 530                 timeo = schedule_timeout(timeo);
 531                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 532         }
 533         __set_current_state(TASK_RUNNING);
 534         remove_wait_queue(sk_sleep(sk), &wait);
 535
 536         if (err)
 537                 goto done;
 538
 539         newsock->state = SS_CONNECTED;
 540
 541         BT_DBG("new socket %p", nsk);
 542
 543 done:
 544         release_sock(sk);
 545         return err;
 546 }
 547
 548 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 549 {
 550         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 551         struct sock *sk = sock->sk;
 552
 553         BT_DBG("sock %p, sk %p", sock, sk);
 554
 555         memset(sa, 0, sizeof(*sa));
 556         sa->rc_family  = AF_BLUETOOTH;
 557         sa->rc_channel = rfcomm_pi(sk)->channel;
 558         if (peer)
 559                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 560         else
 561                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 562
 563         *len = sizeof(struct sockaddr_rc);
 564         return 0;
 565 }
 566
 567 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 568                                struct msghdr *msg, size_t len)
 569 {
 570         struct sock *sk = sock->sk;
 571         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 572         struct sk_buff *skb;
 573         int sent = 0;
 574
 575         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 576                 return -ENOTCONN;
 577
 578         if (msg->msg_flags & MSG_OOB)
 579                 return -EOPNOTSUPP;
 580
 581         if (sk->sk_shutdown & SEND_SHUTDOWN)
 582                 return -EPIPE;
 583
 584         BT_DBG("sock %p, sk %p", sock, sk);
 585
 586         lock_sock(sk);
 587
 588         while (len) {
 589                 size_t size = min_t(size_t, len, d->mtu);
 590                 int err;
 591
 592                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 593                                 msg->msg_flags & MSG_DONTWAIT, &err);
 594                 if (!skb) {
 595                         if (sent == 0)
 596                                 sent = err;
 597                         break;
 598                 }
 599                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 600
 601                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 602                 if (err) {
 603                         kfree_skb(skb);
 604                         if (sent == 0)
 605                                 sent = err;
 606                         break;
 607                 }
 608
 609                 err = rfcomm_dlc_send(d, skb);
 610                 if (err < 0) {
 611                         kfree_skb(skb);
 612                         if (sent == 0)
 613                                 sent = err;
 614                         break;
 615                 }
 616
 617                 sent += size;
 618                 len  -= size;
 619         }
 620
 621         release_sock(sk);
 622
 623         return sent;
 624 }
 625
 626 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 627                                struct msghdr *msg, size_t size, int flags)
 628 {
 629         struct sock *sk = sock->sk;
 630         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 631         int len;
 632
 633         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 634                 rfcomm_dlc_accept(d);
 635                 return 0;
 636         }
 637
 638         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 639
 640         lock_sock(sk);
 641         if (!(flags & MSG_PEEK) && len > 0)
 642                 atomic_sub(len, &sk->sk_rmem_alloc);
 643
 644         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 645                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 646         release_sock(sk);
 647
 648         return len;
 649 }
 650
 651 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 652 {
 653         struct sock *sk = sock->sk;
 654         int err = 0;
 655         u32 opt;
 656
 657         BT_DBG("sk %p", sk);
 658
 659         lock_sock(sk);
 660
 661         switch (optname) {
 662         case RFCOMM_LM:
 663                 if (get_user(opt, (u32 __user *) optval)) {
 664                         err = -EFAULT;
 665                         break;
 666                 }
 667
 668                 if (opt & RFCOMM_LM_AUTH)
 669                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 670                 if (opt & RFCOMM_LM_ENCRYPT)
 671                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 672                 if (opt & RFCOMM_LM_SECURE)
 673                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 674
 675                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 676                 break;
 677
 678         default:
 679                 err = -ENOPROTOOPT;
 680                 break;
 681         }
 682
 683         release_sock(sk);
 684         return err;
 685 }
 686
 687 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 688 {
 689         struct sock *sk = sock->sk;
 690         struct bt_security sec;
 691         int err = 0;
 692         size_t len;
 693         u32 opt;
 694
 695         BT_DBG("sk %p", sk);
 696
 697         if (level == SOL_RFCOMM)
 698                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 699
 700         if (level != SOL_BLUETOOTH)
 701                 return -ENOPROTOOPT;
 702
 703         lock_sock(sk);
 704
 705         switch (optname) {
 706         case BT_SECURITY:
 707                 if (sk->sk_type != SOCK_STREAM) {
 708                         err = -EINVAL;
 709                         break;
 710                 }
 711
 712                 sec.level = BT_SECURITY_LOW;
 713
 714                 len = min_t(unsigned int, sizeof(sec), optlen);
 715                 if (copy_from_user((char *) &sec, optval, len)) {
 716                         err = -EFAULT;
 717                         break;
 718                 }
 719
 720                 if (sec.level > BT_SECURITY_HIGH) {
 721                         err = -EINVAL;
 722                         break;
 723                 }
 724
 725                 rfcomm_pi(sk)->sec_level = sec.level;
 726                 break;
 727
 728         case BT_DEFER_SETUP:
 729                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 730                         err = -EINVAL;
 731                         break;
 732                 }
 733
 734                 if (get_user(opt, (u32 __user *) optval)) {
 735                         err = -EFAULT;
 736                         break;
 737                 }
 738
 739                 bt_sk(sk)->defer_setup = opt;
 740                 break;
 741
 742         default:
 743                 err = -ENOPROTOOPT;
 744                 break;
 745         }
 746
 747         release_sock(sk);
 748         return err;
 749 }
 750
 751 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 752 {
 753         struct sock *sk = sock->sk;
 754         struct rfcomm_conninfo cinfo;
 755         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 756         int len, err = 0;
 757         u32 opt;
 758
 759         BT_DBG("sk %p", sk);
 760
 761         if (get_user(len, optlen))
 762                 return -EFAULT;
 763
 764         lock_sock(sk);
 765
 766         switch (optname) {
 767         case RFCOMM_LM:
 768                 switch (rfcomm_pi(sk)->sec_level) {
 769                 case BT_SECURITY_LOW:
 770                         opt = RFCOMM_LM_AUTH;
 771                         break;
 772                 case BT_SECURITY_MEDIUM:
 773                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 774                         break;
 775                 case BT_SECURITY_HIGH:
 776                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 777                                                         RFCOMM_LM_SECURE;
 778                         break;
 779                 default:
 780                         opt = 0;
 781                         break;
 782                 }
 783
 784                 if (rfcomm_pi(sk)->role_switch)
 785                         opt |= RFCOMM_LM_MASTER;
 786
 787                 if (put_user(opt, (u32 __user *) optval))
 788                         err = -EFAULT;
 789                 break;
 790
 791         case RFCOMM_CONNINFO:
 792                 if (sk->sk_state != BT_CONNECTED &&
 793                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 794                         err = -ENOTCONN;
 795                         break;
 796                 }
 797
 798                 memset(&cinfo, 0, sizeof(cinfo));
 799                 cinfo.hci_handle = conn->hcon->handle;
 800                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 801
 802                 len = min_t(unsigned int, len, sizeof(cinfo));
 803                 if (copy_to_user(optval, (char *) &cinfo, len))
 804                         err = -EFAULT;
 805
 806                 break;
 807
 808         default:
 809                 err = -ENOPROTOOPT;
 810                 break;
 811         }
 812
 813         release_sock(sk);
 814         return err;
 815 }
 816
 817 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 818 {
 819         struct sock *sk = sock->sk;
 820         struct bt_security sec;
 821         int len, err = 0;
 822
 823         BT_DBG("sk %p", sk);
 824
 825         if (level == SOL_RFCOMM)
 826                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 827
 828         if (level != SOL_BLUETOOTH)
 829                 return -ENOPROTOOPT;
 830
 831         if (get_user(len, optlen))
 832                 return -EFAULT;
 833
 834         lock_sock(sk);
 835
 836         switch (optname) {
 837         case BT_SECURITY:
 838                 if (sk->sk_type != SOCK_STREAM) {
 839                         err = -EINVAL;
 840                         break;
 841                 }
 842
 843                 sec.level = rfcomm_pi(sk)->sec_level;
 844                 sec.key_size = 0;
 845
 846                 len = min_t(unsigned int, len, sizeof(sec));
 847                 if (copy_to_user(optval, (char *) &sec, len))
 848                         err = -EFAULT;
 849
 850                 break;
 851
 852         case BT_DEFER_SETUP:
 853                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 854                         err = -EINVAL;
 855                         break;
 856                 }
 857
 858                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
 859                         err = -EFAULT;
 860
 861                 break;
 862
 863         default:
 864                 err = -ENOPROTOOPT;
 865                 break;
 866         }
 867
 868         release_sock(sk);
 869         return err;
 870 }
 871
 872 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 873 {
 874         struct sock *sk __maybe_unused = sock->sk;
 875         int err;
 876
 877         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 878
 879         err = bt_sock_ioctl(sock, cmd, arg);
 880
 881         if (err == -ENOIOCTLCMD) {
 882 #ifdef CONFIG_BT_RFCOMM_TTY
 883                 lock_sock(sk);
 884                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 885                 release_sock(sk);
 886 #else
 887                 err = -EOPNOTSUPP;
 888 #endif
 889         }
 890
 891         return err;
 892 }
 893
 894 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 895 {
 896         struct sock *sk = sock->sk;
 897         int err = 0;
 898
 899         BT_DBG("sock %p, sk %p", sock, sk);
 900
 901         if (!sk)
 902                 return 0;
 903
 904         lock_sock(sk);
 905         if (!sk->sk_shutdown) {
 906                 sk->sk_shutdown = SHUTDOWN_MASK;
 907                 __rfcomm_sock_close(sk);
 908
 909                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
 910                     !(current->flags & PF_EXITING))
 911                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 912         }
 913         release_sock(sk);
 914         return err;
 915 }
 916
 917 static int rfcomm_sock_release(struct socket *sock)
 918 {
 919         struct sock *sk = sock->sk;
 920         int err;
 921
 922         BT_DBG("sock %p, sk %p", sock, sk);
 923
 924         if (!sk)
 925                 return 0;
 926
 927         err = rfcomm_sock_shutdown(sock, 2);
 928
 929         sock_orphan(sk);
 930         rfcomm_sock_kill(sk);
 931         return err;
 932 }
 933
 934 /* ---- RFCOMM core layer callbacks ----
 935  *
 936  * called under rfcomm_lock()
 937  */
 938 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 939 {
 940         struct sock *sk, *parent;
 941         bdaddr_t src, dst;
 942         int result = 0;
 943
 944         BT_DBG("session %p channel %d", s, channel);
 945
 946         rfcomm_session_getaddr(s, &src, &dst);
 947
 948         /* Check if we have socket listening on channel */
 949         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 950         if (!parent)
 951                 return 0;
 952
 953         bh_lock_sock(parent);
 954
 955         /* Check for backlog size */
 956         if (sk_acceptq_is_full(parent)) {
 957                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 958                 goto done;
 959         }
 960
 961         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 962         if (!sk)
 963                 goto done;
 964
 965         rfcomm_sock_init(sk, parent);
 966         bacpy(&bt_sk(sk)->src, &src);
 967         bacpy(&bt_sk(sk)->dst, &dst);
 968         rfcomm_pi(sk)->channel = channel;
 969
 970         sk->sk_state = BT_CONFIG;
 971         bt_accept_enqueue(parent, sk);
 972
 973         /* Accept connection and return socket DLC */
 974         *d = rfcomm_pi(sk)->dlc;
 975         result = 1;
 976
 977 done:
 978         bh_unlock_sock(parent);
 979
 980         if (bt_sk(parent)->defer_setup)
 981                 parent->sk_state_change(parent);
 982
 983         return result;
 984 }
 985
 986 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 987 {
 988         struct sock *sk;
 989         struct hlist_node *node;
 990
 991         read_lock_bh(&rfcomm_sk_list.lock);
 992
 993         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 994                 seq_printf(f, "%s %s %d %d\n",
 995                                 batostr(&bt_sk(sk)->src),
 996                                 batostr(&bt_sk(sk)->dst),
 997                                 sk->sk_state, rfcomm_pi(sk)->channel);
 998         }
 999
1000         read_unlock_bh(&rfcomm_sk_list.lock);
1001
1002         return 0;
1003 }
1004
1005 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
1006 {
1007         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1008 }
1009
1010 static const struct file_operations rfcomm_sock_debugfs_fops = {
1011         .open           = rfcomm_sock_debugfs_open,
1012         .read           = seq_read,
1013         .llseek         = seq_lseek,
1014         .release        = single_release,
1015 };
1016
1017 static struct dentry *rfcomm_sock_debugfs;
1018
1019 static const struct proto_ops rfcomm_sock_ops = {
1020         .family         = PF_BLUETOOTH,
1021         .owner          = THIS_MODULE,
1022         .release        = rfcomm_sock_release,
1023         .bind           = rfcomm_sock_bind,
1024         .connect        = rfcomm_sock_connect,
1025         .listen         = rfcomm_sock_listen,
1026         .accept         = rfcomm_sock_accept,
1027         .getname        = rfcomm_sock_getname,
1028         .sendmsg        = rfcomm_sock_sendmsg,
1029         .recvmsg        = rfcomm_sock_recvmsg,
1030         .shutdown       = rfcomm_sock_shutdown,
1031         .setsockopt     = rfcomm_sock_setsockopt,
1032         .getsockopt     = rfcomm_sock_getsockopt,
1033         .ioctl          = rfcomm_sock_ioctl,
1034         .poll           = bt_sock_poll,
1035         .socketpair     = sock_no_socketpair,
1036         .mmap           = sock_no_mmap
1037 };
1038
1039 static const struct net_proto_family rfcomm_sock_family_ops = {
1040         .family         = PF_BLUETOOTH,
1041         .owner          = THIS_MODULE,
1042         .create         = rfcomm_sock_create
1043 };
1044
1045 int __init rfcomm_init_sockets(void)
1046 {
1047         int err;
1048
1049         err = proto_register(&rfcomm_proto, 0);
1050         if (err < 0)
1051                 return err;
1052
1053         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1054         if (err < 0)
1055                 goto error;
1056
1057         if (bt_debugfs) {
1058                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1059                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1060                 if (!rfcomm_sock_debugfs)
1061                         BT_ERR("Failed to create RFCOMM debug file");
1062         }
1063
1064         BT_INFO("RFCOMM socket layer initialized");
1065
1066         return 0;
1067
1068 error:
1069         BT_ERR("RFCOMM socket layer registration failed");
1070         proto_unregister(&rfcomm_proto);
1071         return err;
1072 }
1073
1074 void __exit rfcomm_cleanup_sockets(void)
1075 {
1076         debugfs_remove(rfcomm_sock_debugfs);
1077
1078         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1079                 BT_ERR("RFCOMM socket layer unregistration failed");
1080
1081         proto_unregister(&rfcomm_proto);
1082 }