Bluetooth: Replace RFCOMM link mode with security level
[pandora-kernel.git] / net / bluetooth / rfcomm / sock.c
1 /*
2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License version 2 as
8    published by the Free Software Foundation;
9
10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21    SOFTWARE IS DISCLAIMED.
22 */
23
24 /*
25  * RFCOMM sockets.
26  */
27
28 #include <linux/module.h>
29
30 #include <linux/types.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/slab.h>
35 #include <linux/poll.h>
36 #include <linux/fcntl.h>
37 #include <linux/init.h>
38 #include <linux/interrupt.h>
39 #include <linux/socket.h>
40 #include <linux/skbuff.h>
41 #include <linux/list.h>
42 #include <linux/device.h>
43 #include <net/sock.h>
44
45 #include <asm/system.h>
46 #include <asm/uaccess.h>
47
48 #include <net/bluetooth/bluetooth.h>
49 #include <net/bluetooth/hci_core.h>
50 #include <net/bluetooth/l2cap.h>
51 #include <net/bluetooth/rfcomm.h>
52
53 static const struct proto_ops rfcomm_sock_ops;
54
55 static struct bt_sock_list rfcomm_sk_list = {
56         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
57 };
58
59 static void rfcomm_sock_close(struct sock *sk);
60 static void rfcomm_sock_kill(struct sock *sk);
61
62 /* ---- DLC callbacks ----
63  *
64  * called under rfcomm_dlc_lock()
65  */
66 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
67 {
68         struct sock *sk = d->owner;
69         if (!sk)
70                 return;
71
72         atomic_add(skb->len, &sk->sk_rmem_alloc);
73         skb_queue_tail(&sk->sk_receive_queue, skb);
74         sk->sk_data_ready(sk, skb->len);
75
76         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
77                 rfcomm_dlc_throttle(d);
78 }
79
80 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
81 {
82         struct sock *sk = d->owner, *parent;
83         if (!sk)
84                 return;
85
86         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
87
88         bh_lock_sock(sk);
89
90         if (err)
91                 sk->sk_err = err;
92
93         sk->sk_state = d->state;
94
95         parent = bt_sk(sk)->parent;
96         if (parent) {
97                 if (d->state == BT_CLOSED) {
98                         sock_set_flag(sk, SOCK_ZAPPED);
99                         bt_accept_unlink(sk);
100                 }
101                 parent->sk_data_ready(parent, 0);
102         } else {
103                 if (d->state == BT_CONNECTED)
104                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
105                 sk->sk_state_change(sk);
106         }
107
108         bh_unlock_sock(sk);
109
110         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
111                 /* We have to drop DLC lock here, otherwise
112                  * rfcomm_sock_destruct() will dead lock. */
113                 rfcomm_dlc_unlock(d);
114                 rfcomm_sock_kill(sk);
115                 rfcomm_dlc_lock(d);
116         }
117 }
118
119 /* ---- Socket functions ---- */
120 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
121 {
122         struct sock *sk = NULL;
123         struct hlist_node *node;
124
125         sk_for_each(sk, node, &rfcomm_sk_list.head) {
126                 if (rfcomm_pi(sk)->channel == channel &&
127                                 !bacmp(&bt_sk(sk)->src, src))
128                         break;
129         }
130
131         return node ? sk : NULL;
132 }
133
134 /* Find socket with channel and source bdaddr.
135  * Returns closest match.
136  */
137 static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
138 {
139         struct sock *sk = NULL, *sk1 = NULL;
140         struct hlist_node *node;
141
142         sk_for_each(sk, node, &rfcomm_sk_list.head) {
143                 if (state && sk->sk_state != state)
144                         continue;
145
146                 if (rfcomm_pi(sk)->channel == channel) {
147                         /* Exact match. */
148                         if (!bacmp(&bt_sk(sk)->src, src))
149                                 break;
150
151                         /* Closest match */
152                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
153                                 sk1 = sk;
154                 }
155         }
156         return node ? sk : sk1;
157 }
158
159 /* Find socket with given address (channel, src).
160  * Returns locked socket */
161 static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
162 {
163         struct sock *s;
164         read_lock(&rfcomm_sk_list.lock);
165         s = __rfcomm_get_sock_by_channel(state, channel, src);
166         if (s) bh_lock_sock(s);
167         read_unlock(&rfcomm_sk_list.lock);
168         return s;
169 }
170
171 static void rfcomm_sock_destruct(struct sock *sk)
172 {
173         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
174
175         BT_DBG("sk %p dlc %p", sk, d);
176
177         skb_queue_purge(&sk->sk_receive_queue);
178         skb_queue_purge(&sk->sk_write_queue);
179
180         rfcomm_dlc_lock(d);
181         rfcomm_pi(sk)->dlc = NULL;
182
183         /* Detach DLC if it's owned by this socket */
184         if (d->owner == sk)
185                 d->owner = NULL;
186         rfcomm_dlc_unlock(d);
187
188         rfcomm_dlc_put(d);
189 }
190
191 static void rfcomm_sock_cleanup_listen(struct sock *parent)
192 {
193         struct sock *sk;
194
195         BT_DBG("parent %p", parent);
196
197         /* Close not yet accepted dlcs */
198         while ((sk = bt_accept_dequeue(parent, NULL))) {
199                 rfcomm_sock_close(sk);
200                 rfcomm_sock_kill(sk);
201         }
202
203         parent->sk_state  = BT_CLOSED;
204         sock_set_flag(parent, SOCK_ZAPPED);
205 }
206
207 /* Kill socket (only if zapped and orphan)
208  * Must be called on unlocked socket.
209  */
210 static void rfcomm_sock_kill(struct sock *sk)
211 {
212         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
213                 return;
214
215         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
216
217         /* Kill poor orphan */
218         bt_sock_unlink(&rfcomm_sk_list, sk);
219         sock_set_flag(sk, SOCK_DEAD);
220         sock_put(sk);
221 }
222
223 static void __rfcomm_sock_close(struct sock *sk)
224 {
225         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
226
227         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
228
229         switch (sk->sk_state) {
230         case BT_LISTEN:
231                 rfcomm_sock_cleanup_listen(sk);
232                 break;
233
234         case BT_CONNECT:
235         case BT_CONNECT2:
236         case BT_CONFIG:
237         case BT_CONNECTED:
238                 rfcomm_dlc_close(d, 0);
239
240         default:
241                 sock_set_flag(sk, SOCK_ZAPPED);
242                 break;
243         }
244 }
245
246 /* Close socket.
247  * Must be called on unlocked socket.
248  */
249 static void rfcomm_sock_close(struct sock *sk)
250 {
251         lock_sock(sk);
252         __rfcomm_sock_close(sk);
253         release_sock(sk);
254 }
255
256 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
257 {
258         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
259
260         BT_DBG("sk %p", sk);
261
262         if (parent) {
263                 sk->sk_type = parent->sk_type;
264                 pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
265
266                 pi->sec_level = rfcomm_pi(parent)->sec_level;
267                 pi->role_switch = rfcomm_pi(parent)->role_switch;
268         } else {
269                 pi->dlc->defer_setup = 0;
270
271                 pi->sec_level = BT_SECURITY_LOW;
272                 pi->role_switch = 0;
273         }
274
275         pi->dlc->sec_level = pi->sec_level;
276         pi->dlc->role_switch = pi->role_switch;
277 }
278
279 static struct proto rfcomm_proto = {
280         .name           = "RFCOMM",
281         .owner          = THIS_MODULE,
282         .obj_size       = sizeof(struct rfcomm_pinfo)
283 };
284
285 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
286 {
287         struct rfcomm_dlc *d;
288         struct sock *sk;
289
290         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
291         if (!sk)
292                 return NULL;
293
294         sock_init_data(sock, sk);
295         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
296
297         d = rfcomm_dlc_alloc(prio);
298         if (!d) {
299                 sk_free(sk);
300                 return NULL;
301         }
302
303         d->data_ready   = rfcomm_sk_data_ready;
304         d->state_change = rfcomm_sk_state_change;
305
306         rfcomm_pi(sk)->dlc = d;
307         d->owner = sk;
308
309         sk->sk_destruct = rfcomm_sock_destruct;
310         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
311
312         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
313         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
314
315         sock_reset_flag(sk, SOCK_ZAPPED);
316
317         sk->sk_protocol = proto;
318         sk->sk_state    = BT_OPEN;
319
320         bt_sock_link(&rfcomm_sk_list, sk);
321
322         BT_DBG("sk %p", sk);
323         return sk;
324 }
325
326 static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
327 {
328         struct sock *sk;
329
330         BT_DBG("sock %p", sock);
331
332         sock->state = SS_UNCONNECTED;
333
334         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
335                 return -ESOCKTNOSUPPORT;
336
337         sock->ops = &rfcomm_sock_ops;
338
339         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
340         if (!sk)
341                 return -ENOMEM;
342
343         rfcomm_sock_init(sk, NULL);
344         return 0;
345 }
346
347 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
348 {
349         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
350         struct sock *sk = sock->sk;
351         int err = 0;
352
353         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
354
355         if (!addr || addr->sa_family != AF_BLUETOOTH)
356                 return -EINVAL;
357
358         lock_sock(sk);
359
360         if (sk->sk_state != BT_OPEN) {
361                 err = -EBADFD;
362                 goto done;
363         }
364
365         if (sk->sk_type != SOCK_STREAM) {
366                 err = -EINVAL;
367                 goto done;
368         }
369
370         write_lock_bh(&rfcomm_sk_list.lock);
371
372         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
373                 err = -EADDRINUSE;
374         } else {
375                 /* Save source address */
376                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
377                 rfcomm_pi(sk)->channel = sa->rc_channel;
378                 sk->sk_state = BT_BOUND;
379         }
380
381         write_unlock_bh(&rfcomm_sk_list.lock);
382
383 done:
384         release_sock(sk);
385         return err;
386 }
387
388 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
389 {
390         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
391         struct sock *sk = sock->sk;
392         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
393         int err = 0;
394
395         BT_DBG("sk %p", sk);
396
397         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
398                 return -EINVAL;
399
400         lock_sock(sk);
401
402         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
403                 err = -EBADFD;
404                 goto done;
405         }
406
407         if (sk->sk_type != SOCK_STREAM) {
408                 err = -EINVAL;
409                 goto done;
410         }
411
412         sk->sk_state = BT_CONNECT;
413         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
414         rfcomm_pi(sk)->channel = sa->rc_channel;
415
416         d->sec_level = rfcomm_pi(sk)->sec_level;
417         d->role_switch = rfcomm_pi(sk)->role_switch;
418
419         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
420         if (!err)
421                 err = bt_sock_wait_state(sk, BT_CONNECTED,
422                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
423
424 done:
425         release_sock(sk);
426         return err;
427 }
428
429 static int rfcomm_sock_listen(struct socket *sock, int backlog)
430 {
431         struct sock *sk = sock->sk;
432         int err = 0;
433
434         BT_DBG("sk %p backlog %d", sk, backlog);
435
436         lock_sock(sk);
437
438         if (sk->sk_state != BT_BOUND) {
439                 err = -EBADFD;
440                 goto done;
441         }
442
443         if (sk->sk_type != SOCK_STREAM) {
444                 err = -EINVAL;
445                 goto done;
446         }
447
448         if (!rfcomm_pi(sk)->channel) {
449                 bdaddr_t *src = &bt_sk(sk)->src;
450                 u8 channel;
451
452                 err = -EINVAL;
453
454                 write_lock_bh(&rfcomm_sk_list.lock);
455
456                 for (channel = 1; channel < 31; channel++)
457                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
458                                 rfcomm_pi(sk)->channel = channel;
459                                 err = 0;
460                                 break;
461                         }
462
463                 write_unlock_bh(&rfcomm_sk_list.lock);
464
465                 if (err < 0)
466                         goto done;
467         }
468
469         sk->sk_max_ack_backlog = backlog;
470         sk->sk_ack_backlog = 0;
471         sk->sk_state = BT_LISTEN;
472
473 done:
474         release_sock(sk);
475         return err;
476 }
477
478 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
479 {
480         DECLARE_WAITQUEUE(wait, current);
481         struct sock *sk = sock->sk, *nsk;
482         long timeo;
483         int err = 0;
484
485         lock_sock(sk);
486
487         if (sk->sk_state != BT_LISTEN) {
488                 err = -EBADFD;
489                 goto done;
490         }
491
492         if (sk->sk_type != SOCK_STREAM) {
493                 err = -EINVAL;
494                 goto done;
495         }
496
497         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
498
499         BT_DBG("sk %p timeo %ld", sk, timeo);
500
501         /* Wait for an incoming connection. (wake-one). */
502         add_wait_queue_exclusive(sk->sk_sleep, &wait);
503         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
504                 set_current_state(TASK_INTERRUPTIBLE);
505                 if (!timeo) {
506                         err = -EAGAIN;
507                         break;
508                 }
509
510                 release_sock(sk);
511                 timeo = schedule_timeout(timeo);
512                 lock_sock(sk);
513
514                 if (sk->sk_state != BT_LISTEN) {
515                         err = -EBADFD;
516                         break;
517                 }
518
519                 if (signal_pending(current)) {
520                         err = sock_intr_errno(timeo);
521                         break;
522                 }
523         }
524         set_current_state(TASK_RUNNING);
525         remove_wait_queue(sk->sk_sleep, &wait);
526
527         if (err)
528                 goto done;
529
530         newsock->state = SS_CONNECTED;
531
532         BT_DBG("new socket %p", nsk);
533
534 done:
535         release_sock(sk);
536         return err;
537 }
538
539 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
540 {
541         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
542         struct sock *sk = sock->sk;
543
544         BT_DBG("sock %p, sk %p", sock, sk);
545
546         sa->rc_family  = AF_BLUETOOTH;
547         sa->rc_channel = rfcomm_pi(sk)->channel;
548         if (peer)
549                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
550         else
551                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
552
553         *len = sizeof(struct sockaddr_rc);
554         return 0;
555 }
556
557 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
558                                struct msghdr *msg, size_t len)
559 {
560         struct sock *sk = sock->sk;
561         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
562         struct sk_buff *skb;
563         int sent = 0;
564
565         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
566                 return -ENOTCONN;
567
568         if (msg->msg_flags & MSG_OOB)
569                 return -EOPNOTSUPP;
570
571         if (sk->sk_shutdown & SEND_SHUTDOWN)
572                 return -EPIPE;
573
574         BT_DBG("sock %p, sk %p", sock, sk);
575
576         lock_sock(sk);
577
578         while (len) {
579                 size_t size = min_t(size_t, len, d->mtu);
580                 int err;
581
582                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
583                                 msg->msg_flags & MSG_DONTWAIT, &err);
584                 if (!skb) {
585                         if (sent == 0)
586                                 sent = err;
587                         break;
588                 }
589                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
590
591                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
592                 if (err) {
593                         kfree_skb(skb);
594                         if (sent == 0)
595                                 sent = err;
596                         break;
597                 }
598
599                 err = rfcomm_dlc_send(d, skb);
600                 if (err < 0) {
601                         kfree_skb(skb);
602                         if (sent == 0)
603                                 sent = err;
604                         break;
605                 }
606
607                 sent += size;
608                 len  -= size;
609         }
610
611         release_sock(sk);
612
613         return sent;
614 }
615
616 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
617 {
618         DECLARE_WAITQUEUE(wait, current);
619
620         add_wait_queue(sk->sk_sleep, &wait);
621         for (;;) {
622                 set_current_state(TASK_INTERRUPTIBLE);
623
624                 if (!skb_queue_empty(&sk->sk_receive_queue) ||
625                     sk->sk_err ||
626                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
627                     signal_pending(current) ||
628                     !timeo)
629                         break;
630
631                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
632                 release_sock(sk);
633                 timeo = schedule_timeout(timeo);
634                 lock_sock(sk);
635                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
636         }
637
638         __set_current_state(TASK_RUNNING);
639         remove_wait_queue(sk->sk_sleep, &wait);
640         return timeo;
641 }
642
643 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
644                                struct msghdr *msg, size_t size, int flags)
645 {
646         struct sock *sk = sock->sk;
647         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
648         int err = 0;
649         size_t target, copied = 0;
650         long timeo;
651
652         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
653                 rfcomm_dlc_accept(d);
654                 return 0;
655         }
656
657         if (flags & MSG_OOB)
658                 return -EOPNOTSUPP;
659
660         msg->msg_namelen = 0;
661
662         BT_DBG("sk %p size %zu", sk, size);
663
664         lock_sock(sk);
665
666         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
667         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
668
669         do {
670                 struct sk_buff *skb;
671                 int chunk;
672
673                 skb = skb_dequeue(&sk->sk_receive_queue);
674                 if (!skb) {
675                         if (copied >= target)
676                                 break;
677
678                         if ((err = sock_error(sk)) != 0)
679                                 break;
680                         if (sk->sk_shutdown & RCV_SHUTDOWN)
681                                 break;
682
683                         err = -EAGAIN;
684                         if (!timeo)
685                                 break;
686
687                         timeo = rfcomm_sock_data_wait(sk, timeo);
688
689                         if (signal_pending(current)) {
690                                 err = sock_intr_errno(timeo);
691                                 goto out;
692                         }
693                         continue;
694                 }
695
696                 chunk = min_t(unsigned int, skb->len, size);
697                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
698                         skb_queue_head(&sk->sk_receive_queue, skb);
699                         if (!copied)
700                                 copied = -EFAULT;
701                         break;
702                 }
703                 copied += chunk;
704                 size   -= chunk;
705
706                 sock_recv_timestamp(msg, sk, skb);
707
708                 if (!(flags & MSG_PEEK)) {
709                         atomic_sub(chunk, &sk->sk_rmem_alloc);
710
711                         skb_pull(skb, chunk);
712                         if (skb->len) {
713                                 skb_queue_head(&sk->sk_receive_queue, skb);
714                                 break;
715                         }
716                         kfree_skb(skb);
717
718                 } else {
719                         /* put message back and return */
720                         skb_queue_head(&sk->sk_receive_queue, skb);
721                         break;
722                 }
723         } while (size);
724
725 out:
726         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
727                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
728
729         release_sock(sk);
730         return copied ? : err;
731 }
732
733 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
734 {
735         struct sock *sk = sock->sk;
736         int err = 0;
737         u32 opt;
738
739         BT_DBG("sk %p", sk);
740
741         lock_sock(sk);
742
743         switch (optname) {
744         case RFCOMM_LM:
745                 if (get_user(opt, (u32 __user *) optval)) {
746                         err = -EFAULT;
747                         break;
748                 }
749
750                 if (opt & RFCOMM_LM_AUTH)
751                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
752                 if (opt & RFCOMM_LM_ENCRYPT)
753                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
754                 if (opt & RFCOMM_LM_SECURE)
755                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
756
757                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
758                 break;
759
760         default:
761                 err = -ENOPROTOOPT;
762                 break;
763         }
764
765         release_sock(sk);
766         return err;
767 }
768
769 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
770 {
771         struct sock *sk = sock->sk;
772         struct bt_security sec;
773         int len, err = 0;
774         u32 opt;
775
776         BT_DBG("sk %p", sk);
777
778         if (level == SOL_RFCOMM)
779                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
780
781         lock_sock(sk);
782
783         switch (optname) {
784         case BT_SECURITY:
785                 sec.level = BT_SECURITY_LOW;
786
787                 len = min_t(unsigned int, sizeof(sec), optlen);
788                 if (copy_from_user((char *) &sec, optval, len)) {
789                         err = -EFAULT;
790                         break;
791                 }
792
793                 if (sec.level > BT_SECURITY_HIGH) {
794                         err = -EINVAL;
795                         break;
796                 }
797
798                 rfcomm_pi(sk)->sec_level = sec.level;
799                 break;
800
801         case BT_DEFER_SETUP:
802                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
803                         err = -EINVAL;
804                         break;
805                 }
806
807                 if (get_user(opt, (u32 __user *) optval)) {
808                         err = -EFAULT;
809                         break;
810                 }
811
812                 bt_sk(sk)->defer_setup = opt;
813                 break;
814
815         default:
816                 err = -ENOPROTOOPT;
817                 break;
818         }
819
820         release_sock(sk);
821         return err;
822 }
823
824 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
825 {
826         struct sock *sk = sock->sk;
827         struct sock *l2cap_sk;
828         struct rfcomm_conninfo cinfo;
829         int len, err = 0;
830         u32 opt;
831
832         BT_DBG("sk %p", sk);
833
834         if (get_user(len, optlen))
835                 return -EFAULT;
836
837         lock_sock(sk);
838
839         switch (optname) {
840         case RFCOMM_LM:
841                 switch (rfcomm_pi(sk)->sec_level) {
842                 case BT_SECURITY_LOW:
843                         opt = RFCOMM_LM_AUTH;
844                         break;
845                 case BT_SECURITY_MEDIUM:
846                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
847                         break;
848                 case BT_SECURITY_HIGH:
849                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
850                                                         RFCOMM_LM_SECURE;
851                         break;
852                 default:
853                         opt = 0;
854                         break;
855                 }
856
857                 if (rfcomm_pi(sk)->role_switch)
858                         opt |= RFCOMM_LM_MASTER;
859
860                 if (put_user(opt, (u32 __user *) optval))
861                         err = -EFAULT;
862                 break;
863
864         case RFCOMM_CONNINFO:
865                 if (sk->sk_state != BT_CONNECTED &&
866                                         !rfcomm_pi(sk)->dlc->defer_setup) {
867                         err = -ENOTCONN;
868                         break;
869                 }
870
871                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
872
873                 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
874                 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
875
876                 len = min_t(unsigned int, len, sizeof(cinfo));
877                 if (copy_to_user(optval, (char *) &cinfo, len))
878                         err = -EFAULT;
879
880                 break;
881
882         default:
883                 err = -ENOPROTOOPT;
884                 break;
885         }
886
887         release_sock(sk);
888         return err;
889 }
890
891 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
892 {
893         struct sock *sk = sock->sk;
894         struct bt_security sec;
895         int len, err = 0;
896
897         BT_DBG("sk %p", sk);
898
899         if (level == SOL_RFCOMM)
900                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
901
902         if (get_user(len, optlen))
903                 return -EFAULT;
904
905         lock_sock(sk);
906
907         switch (optname) {
908         case BT_SECURITY:
909                 sec.level = rfcomm_pi(sk)->sec_level;
910
911                 len = min_t(unsigned int, len, sizeof(sec));
912                 if (copy_to_user(optval, (char *) &sec, len))
913                         err = -EFAULT;
914
915                 break;
916
917         case BT_DEFER_SETUP:
918                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
919                         err = -EINVAL;
920                         break;
921                 }
922
923                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
924                         err = -EFAULT;
925
926                 break;
927
928         default:
929                 err = -ENOPROTOOPT;
930                 break;
931         }
932
933         release_sock(sk);
934         return err;
935 }
936
937 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
938 {
939         struct sock *sk __maybe_unused = sock->sk;
940         int err;
941
942         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
943
944         err = bt_sock_ioctl(sock, cmd, arg);
945
946         if (err == -ENOIOCTLCMD) {
947 #ifdef CONFIG_BT_RFCOMM_TTY
948                 lock_sock(sk);
949                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
950                 release_sock(sk);
951 #else
952                 err = -EOPNOTSUPP;
953 #endif
954         }
955
956         return err;
957 }
958
959 static int rfcomm_sock_shutdown(struct socket *sock, int how)
960 {
961         struct sock *sk = sock->sk;
962         int err = 0;
963
964         BT_DBG("sock %p, sk %p", sock, sk);
965
966         if (!sk) return 0;
967
968         lock_sock(sk);
969         if (!sk->sk_shutdown) {
970                 sk->sk_shutdown = SHUTDOWN_MASK;
971                 __rfcomm_sock_close(sk);
972
973                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
974                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
975         }
976         release_sock(sk);
977         return err;
978 }
979
980 static int rfcomm_sock_release(struct socket *sock)
981 {
982         struct sock *sk = sock->sk;
983         int err;
984
985         BT_DBG("sock %p, sk %p", sock, sk);
986
987         if (!sk)
988                 return 0;
989
990         err = rfcomm_sock_shutdown(sock, 2);
991
992         sock_orphan(sk);
993         rfcomm_sock_kill(sk);
994         return err;
995 }
996
997 /* ---- RFCOMM core layer callbacks ----
998  *
999  * called under rfcomm_lock()
1000  */
1001 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
1002 {
1003         struct sock *sk, *parent;
1004         bdaddr_t src, dst;
1005         int result = 0;
1006
1007         BT_DBG("session %p channel %d", s, channel);
1008
1009         rfcomm_session_getaddr(s, &src, &dst);
1010
1011         /* Check if we have socket listening on channel */
1012         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
1013         if (!parent)
1014                 return 0;
1015
1016         /* Check for backlog size */
1017         if (sk_acceptq_is_full(parent)) {
1018                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1019                 goto done;
1020         }
1021
1022         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
1023         if (!sk)
1024                 goto done;
1025
1026         rfcomm_sock_init(sk, parent);
1027         bacpy(&bt_sk(sk)->src, &src);
1028         bacpy(&bt_sk(sk)->dst, &dst);
1029         rfcomm_pi(sk)->channel = channel;
1030
1031         sk->sk_state = BT_CONFIG;
1032         bt_accept_enqueue(parent, sk);
1033
1034         /* Accept connection and return socket DLC */
1035         *d = rfcomm_pi(sk)->dlc;
1036         result = 1;
1037
1038 done:
1039         bh_unlock_sock(parent);
1040
1041         if (bt_sk(parent)->defer_setup)
1042                 parent->sk_state_change(parent);
1043
1044         return result;
1045 }
1046
1047 static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
1048 {
1049         struct sock *sk;
1050         struct hlist_node *node;
1051         char *str = buf;
1052
1053         read_lock_bh(&rfcomm_sk_list.lock);
1054
1055         sk_for_each(sk, node, &rfcomm_sk_list.head) {
1056                 str += sprintf(str, "%s %s %d %d\n",
1057                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
1058                                 sk->sk_state, rfcomm_pi(sk)->channel);
1059         }
1060
1061         read_unlock_bh(&rfcomm_sk_list.lock);
1062
1063         return (str - buf);
1064 }
1065
1066 static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
1067
1068 static const struct proto_ops rfcomm_sock_ops = {
1069         .family         = PF_BLUETOOTH,
1070         .owner          = THIS_MODULE,
1071         .release        = rfcomm_sock_release,
1072         .bind           = rfcomm_sock_bind,
1073         .connect        = rfcomm_sock_connect,
1074         .listen         = rfcomm_sock_listen,
1075         .accept         = rfcomm_sock_accept,
1076         .getname        = rfcomm_sock_getname,
1077         .sendmsg        = rfcomm_sock_sendmsg,
1078         .recvmsg        = rfcomm_sock_recvmsg,
1079         .shutdown       = rfcomm_sock_shutdown,
1080         .setsockopt     = rfcomm_sock_setsockopt,
1081         .getsockopt     = rfcomm_sock_getsockopt,
1082         .ioctl          = rfcomm_sock_ioctl,
1083         .poll           = bt_sock_poll,
1084         .socketpair     = sock_no_socketpair,
1085         .mmap           = sock_no_mmap
1086 };
1087
1088 static struct net_proto_family rfcomm_sock_family_ops = {
1089         .family         = PF_BLUETOOTH,
1090         .owner          = THIS_MODULE,
1091         .create         = rfcomm_sock_create
1092 };
1093
1094 int __init rfcomm_init_sockets(void)
1095 {
1096         int err;
1097
1098         err = proto_register(&rfcomm_proto, 0);
1099         if (err < 0)
1100                 return err;
1101
1102         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1103         if (err < 0)
1104                 goto error;
1105
1106         if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
1107                 BT_ERR("Failed to create RFCOMM info file");
1108
1109         BT_INFO("RFCOMM socket layer initialized");
1110
1111         return 0;
1112
1113 error:
1114         BT_ERR("RFCOMM socket layer registration failed");
1115         proto_unregister(&rfcomm_proto);
1116         return err;
1117 }
1118
1119 void __exit rfcomm_cleanup_sockets(void)
1120 {
1121         class_remove_file(bt_class, &class_attr_rfcomm);
1122
1123         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1124                 BT_ERR("RFCOMM socket layer unregistration failed");
1125
1126         proto_unregister(&rfcomm_proto);
1127 }