net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/types.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <net/sock.h>
  44
  45 #include <asm/system.h>
  46 #include <asm/uaccess.h>
  47
  48 #include <net/bluetooth/bluetooth.h>
  49 #include <net/bluetooth/hci_core.h>
  50 #include <net/bluetooth/l2cap.h>
  51 #include <net/bluetooth/rfcomm.h>
  52
  53 static const struct proto_ops rfcomm_sock_ops;
  54
  55 static struct bt_sock_list rfcomm_sk_list = {
  56         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  57 };
  58
  59 static void rfcomm_sock_close(struct sock *sk);
  60 static void rfcomm_sock_kill(struct sock *sk);
  61
  62 /* ---- DLC callbacks ----
  63  *
  64  * called under rfcomm_dlc_lock()
  65  */
  66 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  67 {
  68         struct sock *sk = d->owner;
  69         if (!sk)
  70                 return;
  71
  72         atomic_add(skb->len, &sk->sk_rmem_alloc);
  73         skb_queue_tail(&sk->sk_receive_queue, skb);
  74         sk->sk_data_ready(sk, skb->len);
  75
  76         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  77                 rfcomm_dlc_throttle(d);
  78 }
  79
  80 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  81 {
  82         struct sock *sk = d->owner, *parent;
  83         if (!sk)
  84                 return;
  85
  86         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  87
  88         bh_lock_sock(sk);
  89
  90         if (err)
  91                 sk->sk_err = err;
  92
  93         sk->sk_state = d->state;
  94
  95         parent = bt_sk(sk)->parent;
  96         if (parent) {
  97                 if (d->state == BT_CLOSED) {
  98                         sock_set_flag(sk, SOCK_ZAPPED);
  99                         bt_accept_unlink(sk);
 100                 }
 101                 parent->sk_data_ready(parent, 0);
 102         } else {
 103                 if (d->state == BT_CONNECTED)
 104                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 105                 sk->sk_state_change(sk);
 106         }
 107
 108         bh_unlock_sock(sk);
 109
 110         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
 111                 /* We have to drop DLC lock here, otherwise
 112                  * rfcomm_sock_destruct() will dead lock. */
 113                 rfcomm_dlc_unlock(d);
 114                 rfcomm_sock_kill(sk);
 115                 rfcomm_dlc_lock(d);
 116         }
 117 }
 118
 119 /* ---- Socket functions ---- */
 120 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 121 {
 122         struct sock *sk = NULL;
 123         struct hlist_node *node;
 124
 125         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 126                 if (rfcomm_pi(sk)->channel == channel &&
 127                                 !bacmp(&bt_sk(sk)->src, src))
 128                         break;
 129         }
 130
 131         return node ? sk : NULL;
 132 }
 133
 134 /* Find socket with channel and source bdaddr.
 135  * Returns closest match.
 136  */
 137 static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 138 {
 139         struct sock *sk = NULL, *sk1 = NULL;
 140         struct hlist_node *node;
 141
 142         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 143                 if (state && sk->sk_state != state)
 144                         continue;
 145
 146                 if (rfcomm_pi(sk)->channel == channel) {
 147                         /* Exact match. */
 148                         if (!bacmp(&bt_sk(sk)->src, src))
 149                                 break;
 150
 151                         /* Closest match */
 152                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 153                                 sk1 = sk;
 154                 }
 155         }
 156         return node ? sk : sk1;
 157 }
 158
 159 /* Find socket with given address (channel, src).
 160  * Returns locked socket */
 161 static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 162 {
 163         struct sock *s;
 164         read_lock(&rfcomm_sk_list.lock);
 165         s = __rfcomm_get_sock_by_channel(state, channel, src);
 166         if (s) bh_lock_sock(s);
 167         read_unlock(&rfcomm_sk_list.lock);
 168         return s;
 169 }
 170
 171 static void rfcomm_sock_destruct(struct sock *sk)
 172 {
 173         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 174
 175         BT_DBG("sk %p dlc %p", sk, d);
 176
 177         skb_queue_purge(&sk->sk_receive_queue);
 178         skb_queue_purge(&sk->sk_write_queue);
 179
 180         rfcomm_dlc_lock(d);
 181         rfcomm_pi(sk)->dlc = NULL;
 182
 183         /* Detach DLC if it's owned by this socket */
 184         if (d->owner == sk)
 185                 d->owner = NULL;
 186         rfcomm_dlc_unlock(d);
 187
 188         rfcomm_dlc_put(d);
 189 }
 190
 191 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 192 {
 193         struct sock *sk;
 194
 195         BT_DBG("parent %p", parent);
 196
 197         /* Close not yet accepted dlcs */
 198         while ((sk = bt_accept_dequeue(parent, NULL))) {
 199                 rfcomm_sock_close(sk);
 200                 rfcomm_sock_kill(sk);
 201         }
 202
 203         parent->sk_state  = BT_CLOSED;
 204         sock_set_flag(parent, SOCK_ZAPPED);
 205 }
 206
 207 /* Kill socket (only if zapped and orphan)
 208  * Must be called on unlocked socket.
 209  */
 210 static void rfcomm_sock_kill(struct sock *sk)
 211 {
 212         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 213                 return;
 214
 215         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 216
 217         /* Kill poor orphan */
 218         bt_sock_unlink(&rfcomm_sk_list, sk);
 219         sock_set_flag(sk, SOCK_DEAD);
 220         sock_put(sk);
 221 }
 222
 223 static void __rfcomm_sock_close(struct sock *sk)
 224 {
 225         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 226
 227         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 228
 229         switch (sk->sk_state) {
 230         case BT_LISTEN:
 231                 rfcomm_sock_cleanup_listen(sk);
 232                 break;
 233
 234         case BT_CONNECT:
 235         case BT_CONNECT2:
 236         case BT_CONFIG:
 237         case BT_CONNECTED:
 238                 rfcomm_dlc_close(d, 0);
 239
 240         default:
 241                 sock_set_flag(sk, SOCK_ZAPPED);
 242                 break;
 243         }
 244 }
 245
 246 /* Close socket.
 247  * Must be called on unlocked socket.
 248  */
 249 static void rfcomm_sock_close(struct sock *sk)
 250 {
 251         lock_sock(sk);
 252         __rfcomm_sock_close(sk);
 253         release_sock(sk);
 254 }
 255
 256 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 257 {
 258         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 259
 260         BT_DBG("sk %p", sk);
 261
 262         if (parent) {
 263                 sk->sk_type = parent->sk_type;
 264                 pi->link_mode = rfcomm_pi(parent)->link_mode;
 265         } else {
 266                 pi->link_mode = 0;
 267         }
 268
 269         pi->dlc->link_mode = pi->link_mode;
 270 }
 271
 272 static struct proto rfcomm_proto = {
 273         .name           = "RFCOMM",
 274         .owner          = THIS_MODULE,
 275         .obj_size       = sizeof(struct rfcomm_pinfo)
 276 };
 277
 278 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 279 {
 280         struct rfcomm_dlc *d;
 281         struct sock *sk;
 282
 283         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 284         if (!sk)
 285                 return NULL;
 286
 287         sock_init_data(sock, sk);
 288         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 289
 290         d = rfcomm_dlc_alloc(prio);
 291         if (!d) {
 292                 sk_free(sk);
 293                 return NULL;
 294         }
 295
 296         d->data_ready   = rfcomm_sk_data_ready;
 297         d->state_change = rfcomm_sk_state_change;
 298
 299         rfcomm_pi(sk)->dlc = d;
 300         d->owner = sk;
 301
 302         sk->sk_destruct = rfcomm_sock_destruct;
 303         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 304
 305         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 306         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 307
 308         sock_reset_flag(sk, SOCK_ZAPPED);
 309
 310         sk->sk_protocol = proto;
 311         sk->sk_state    = BT_OPEN;
 312
 313         bt_sock_link(&rfcomm_sk_list, sk);
 314
 315         BT_DBG("sk %p", sk);
 316         return sk;
 317 }
 318
 319 static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
 320 {
 321         struct sock *sk;
 322
 323         BT_DBG("sock %p", sock);
 324
 325         sock->state = SS_UNCONNECTED;
 326
 327         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 328                 return -ESOCKTNOSUPPORT;
 329
 330         sock->ops = &rfcomm_sock_ops;
 331
 332         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 333         if (!sk)
 334                 return -ENOMEM;
 335
 336         rfcomm_sock_init(sk, NULL);
 337         return 0;
 338 }
 339
 340 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 341 {
 342         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 343         struct sock *sk = sock->sk;
 344         int err = 0;
 345
 346         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
 347
 348         if (!addr || addr->sa_family != AF_BLUETOOTH)
 349                 return -EINVAL;
 350
 351         lock_sock(sk);
 352
 353         if (sk->sk_state != BT_OPEN) {
 354                 err = -EBADFD;
 355                 goto done;
 356         }
 357
 358         if (sk->sk_type != SOCK_STREAM) {
 359                 err = -EINVAL;
 360                 goto done;
 361         }
 362
 363         write_lock_bh(&rfcomm_sk_list.lock);
 364
 365         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 366                 err = -EADDRINUSE;
 367         } else {
 368                 /* Save source address */
 369                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 370                 rfcomm_pi(sk)->channel = sa->rc_channel;
 371                 sk->sk_state = BT_BOUND;
 372         }
 373
 374         write_unlock_bh(&rfcomm_sk_list.lock);
 375
 376 done:
 377         release_sock(sk);
 378         return err;
 379 }
 380
 381 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 382 {
 383         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 384         struct sock *sk = sock->sk;
 385         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 386         int err = 0;
 387
 388         BT_DBG("sk %p", sk);
 389
 390         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
 391                 return -EINVAL;
 392
 393         lock_sock(sk);
 394
 395         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 396                 err = -EBADFD;
 397                 goto done;
 398         }
 399
 400         if (sk->sk_type != SOCK_STREAM) {
 401                 err = -EINVAL;
 402                 goto done;
 403         }
 404
 405         sk->sk_state = BT_CONNECT;
 406         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 407         rfcomm_pi(sk)->channel = sa->rc_channel;
 408
 409         d->link_mode = rfcomm_pi(sk)->link_mode;
 410
 411         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 412         if (!err)
 413                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 414                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 415
 416 done:
 417         release_sock(sk);
 418         return err;
 419 }
 420
 421 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 422 {
 423         struct sock *sk = sock->sk;
 424         int err = 0;
 425
 426         BT_DBG("sk %p backlog %d", sk, backlog);
 427
 428         lock_sock(sk);
 429
 430         if (sk->sk_state != BT_BOUND) {
 431                 err = -EBADFD;
 432                 goto done;
 433         }
 434
 435         if (sk->sk_type != SOCK_STREAM) {
 436                 err = -EINVAL;
 437                 goto done;
 438         }
 439
 440         if (!rfcomm_pi(sk)->channel) {
 441                 bdaddr_t *src = &bt_sk(sk)->src;
 442                 u8 channel;
 443
 444                 err = -EINVAL;
 445
 446                 write_lock_bh(&rfcomm_sk_list.lock);
 447
 448                 for (channel = 1; channel < 31; channel++)
 449                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 450                                 rfcomm_pi(sk)->channel = channel;
 451                                 err = 0;
 452                                 break;
 453                         }
 454
 455                 write_unlock_bh(&rfcomm_sk_list.lock);
 456
 457                 if (err < 0)
 458                         goto done;
 459         }
 460
 461         sk->sk_max_ack_backlog = backlog;
 462         sk->sk_ack_backlog = 0;
 463         sk->sk_state = BT_LISTEN;
 464
 465 done:
 466         release_sock(sk);
 467         return err;
 468 }
 469
 470 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 471 {
 472         DECLARE_WAITQUEUE(wait, current);
 473         struct sock *sk = sock->sk, *nsk;
 474         long timeo;
 475         int err = 0;
 476
 477         lock_sock(sk);
 478
 479         if (sk->sk_state != BT_LISTEN) {
 480                 err = -EBADFD;
 481                 goto done;
 482         }
 483
 484         if (sk->sk_type != SOCK_STREAM) {
 485                 err = -EINVAL;
 486                 goto done;
 487         }
 488
 489         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 490
 491         BT_DBG("sk %p timeo %ld", sk, timeo);
 492
 493         /* Wait for an incoming connection. (wake-one). */
 494         add_wait_queue_exclusive(sk->sk_sleep, &wait);
 495         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 496                 set_current_state(TASK_INTERRUPTIBLE);
 497                 if (!timeo) {
 498                         err = -EAGAIN;
 499                         break;
 500                 }
 501
 502                 release_sock(sk);
 503                 timeo = schedule_timeout(timeo);
 504                 lock_sock(sk);
 505
 506                 if (sk->sk_state != BT_LISTEN) {
 507                         err = -EBADFD;
 508                         break;
 509                 }
 510
 511                 if (signal_pending(current)) {
 512                         err = sock_intr_errno(timeo);
 513                         break;
 514                 }
 515         }
 516         set_current_state(TASK_RUNNING);
 517         remove_wait_queue(sk->sk_sleep, &wait);
 518
 519         if (err)
 520                 goto done;
 521
 522         newsock->state = SS_CONNECTED;
 523
 524         BT_DBG("new socket %p", nsk);
 525
 526 done:
 527         release_sock(sk);
 528         return err;
 529 }
 530
 531 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 532 {
 533         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 534         struct sock *sk = sock->sk;
 535
 536         BT_DBG("sock %p, sk %p", sock, sk);
 537
 538         sa->rc_family  = AF_BLUETOOTH;
 539         sa->rc_channel = rfcomm_pi(sk)->channel;
 540         if (peer)
 541                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 542         else
 543                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 544
 545         *len = sizeof(struct sockaddr_rc);
 546         return 0;
 547 }
 548
 549 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 550                                struct msghdr *msg, size_t len)
 551 {
 552         struct sock *sk = sock->sk;
 553         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 554         struct sk_buff *skb;
 555         int sent = 0;
 556
 557         if (msg->msg_flags & MSG_OOB)
 558                 return -EOPNOTSUPP;
 559
 560         if (sk->sk_shutdown & SEND_SHUTDOWN)
 561                 return -EPIPE;
 562
 563         BT_DBG("sock %p, sk %p", sock, sk);
 564
 565         lock_sock(sk);
 566
 567         while (len) {
 568                 size_t size = min_t(size_t, len, d->mtu);
 569                 int err;
 570
 571                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 572                                 msg->msg_flags & MSG_DONTWAIT, &err);
 573                 if (!skb) {
 574                         if (sent == 0)
 575                                 sent = err;
 576                         break;
 577                 }
 578                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 579
 580                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 581                 if (err) {
 582                         kfree_skb(skb);
 583                         if (sent == 0)
 584                                 sent = err;
 585                         break;
 586                 }
 587
 588                 err = rfcomm_dlc_send(d, skb);
 589                 if (err < 0) {
 590                         kfree_skb(skb);
 591                         if (sent == 0)
 592                                 sent = err;
 593                         break;
 594                 }
 595
 596                 sent += size;
 597                 len  -= size;
 598         }
 599
 600         release_sock(sk);
 601
 602         return sent;
 603 }
 604
 605 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
 606 {
 607         DECLARE_WAITQUEUE(wait, current);
 608
 609         add_wait_queue(sk->sk_sleep, &wait);
 610         for (;;) {
 611                 set_current_state(TASK_INTERRUPTIBLE);
 612
 613                 if (!skb_queue_empty(&sk->sk_receive_queue) ||
 614                     sk->sk_err ||
 615                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
 616                     signal_pending(current) ||
 617                     !timeo)
 618                         break;
 619
 620                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 621                 release_sock(sk);
 622                 timeo = schedule_timeout(timeo);
 623                 lock_sock(sk);
 624                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 625         }
 626
 627         __set_current_state(TASK_RUNNING);
 628         remove_wait_queue(sk->sk_sleep, &wait);
 629         return timeo;
 630 }
 631
 632 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 633                                struct msghdr *msg, size_t size, int flags)
 634 {
 635         struct sock *sk = sock->sk;
 636         int err = 0;
 637         size_t target, copied = 0;
 638         long timeo;
 639
 640         if (flags & MSG_OOB)
 641                 return -EOPNOTSUPP;
 642
 643         msg->msg_namelen = 0;
 644
 645         BT_DBG("sk %p size %zu", sk, size);
 646
 647         lock_sock(sk);
 648
 649         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
 650         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 651
 652         do {
 653                 struct sk_buff *skb;
 654                 int chunk;
 655
 656                 skb = skb_dequeue(&sk->sk_receive_queue);
 657                 if (!skb) {
 658                         if (copied >= target)
 659                                 break;
 660
 661                         if ((err = sock_error(sk)) != 0)
 662                                 break;
 663                         if (sk->sk_shutdown & RCV_SHUTDOWN)
 664                                 break;
 665
 666                         err = -EAGAIN;
 667                         if (!timeo)
 668                                 break;
 669
 670                         timeo = rfcomm_sock_data_wait(sk, timeo);
 671
 672                         if (signal_pending(current)) {
 673                                 err = sock_intr_errno(timeo);
 674                                 goto out;
 675                         }
 676                         continue;
 677                 }
 678
 679                 chunk = min_t(unsigned int, skb->len, size);
 680                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
 681                         skb_queue_head(&sk->sk_receive_queue, skb);
 682                         if (!copied)
 683                                 copied = -EFAULT;
 684                         break;
 685                 }
 686                 copied += chunk;
 687                 size   -= chunk;
 688
 689                 sock_recv_timestamp(msg, sk, skb);
 690
 691                 if (!(flags & MSG_PEEK)) {
 692                         atomic_sub(chunk, &sk->sk_rmem_alloc);
 693
 694                         skb_pull(skb, chunk);
 695                         if (skb->len) {
 696                                 skb_queue_head(&sk->sk_receive_queue, skb);
 697                                 break;
 698                         }
 699                         kfree_skb(skb);
 700
 701                 } else {
 702                         /* put message back and return */
 703                         skb_queue_head(&sk->sk_receive_queue, skb);
 704                         break;
 705                 }
 706         } while (size);
 707
 708 out:
 709         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 710                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 711
 712         release_sock(sk);
 713         return copied ? : err;
 714 }
 715
 716 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 717 {
 718         struct sock *sk = sock->sk;
 719         int err = 0;
 720         u32 opt;
 721
 722         BT_DBG("sk %p", sk);
 723
 724         lock_sock(sk);
 725
 726         switch (optname) {
 727         case RFCOMM_LM:
 728                 if (get_user(opt, (u32 __user *) optval)) {
 729                         err = -EFAULT;
 730                         break;
 731                 }
 732
 733                 rfcomm_pi(sk)->link_mode = opt;
 734                 break;
 735
 736         default:
 737                 err = -ENOPROTOOPT;
 738                 break;
 739         }
 740
 741         release_sock(sk);
 742         return err;
 743 }
 744
 745 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 746 {
 747         struct sock *sk = sock->sk;
 748         struct sock *l2cap_sk;
 749         struct rfcomm_conninfo cinfo;
 750         int len, err = 0;
 751
 752         BT_DBG("sk %p", sk);
 753
 754         if (get_user(len, optlen))
 755                 return -EFAULT;
 756
 757         lock_sock(sk);
 758
 759         switch (optname) {
 760         case RFCOMM_LM:
 761                 if (put_user(rfcomm_pi(sk)->link_mode, (u32 __user *) optval))
 762                         err = -EFAULT;
 763                 break;
 764
 765         case RFCOMM_CONNINFO:
 766                 if (sk->sk_state != BT_CONNECTED) {
 767                         err = -ENOTCONN;
 768                         break;
 769                 }
 770
 771                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 772
 773                 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
 774                 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
 775
 776                 len = min_t(unsigned int, len, sizeof(cinfo));
 777                 if (copy_to_user(optval, (char *) &cinfo, len))
 778                         err = -EFAULT;
 779
 780                 break;
 781
 782         default:
 783                 err = -ENOPROTOOPT;
 784                 break;
 785         }
 786
 787         release_sock(sk);
 788         return err;
 789 }
 790
 791 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 792 {
 793         struct sock *sk __maybe_unused = sock->sk;
 794         int err;
 795
 796         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 797
 798         err = bt_sock_ioctl(sock, cmd, arg);
 799
 800         if (err == -ENOIOCTLCMD) {
 801 #ifdef CONFIG_BT_RFCOMM_TTY
 802                 lock_sock(sk);
 803                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 804                 release_sock(sk);
 805 #else
 806                 err = -EOPNOTSUPP;
 807 #endif
 808         }
 809
 810         return err;
 811 }
 812
 813 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 814 {
 815         struct sock *sk = sock->sk;
 816         int err = 0;
 817
 818         BT_DBG("sock %p, sk %p", sock, sk);
 819
 820         if (!sk) return 0;
 821
 822         lock_sock(sk);
 823         if (!sk->sk_shutdown) {
 824                 sk->sk_shutdown = SHUTDOWN_MASK;
 825                 __rfcomm_sock_close(sk);
 826
 827                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 828                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 829         }
 830         release_sock(sk);
 831         return err;
 832 }
 833
 834 static int rfcomm_sock_release(struct socket *sock)
 835 {
 836         struct sock *sk = sock->sk;
 837         int err;
 838
 839         BT_DBG("sock %p, sk %p", sock, sk);
 840
 841         if (!sk)
 842                 return 0;
 843
 844         err = rfcomm_sock_shutdown(sock, 2);
 845
 846         sock_orphan(sk);
 847         rfcomm_sock_kill(sk);
 848         return err;
 849 }
 850
 851 /* ---- RFCOMM core layer callbacks ----
 852  *
 853  * called under rfcomm_lock()
 854  */
 855 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 856 {
 857         struct sock *sk, *parent;
 858         bdaddr_t src, dst;
 859         int result = 0;
 860
 861         BT_DBG("session %p channel %d", s, channel);
 862
 863         rfcomm_session_getaddr(s, &src, &dst);
 864
 865         /* Check if we have socket listening on channel */
 866         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 867         if (!parent)
 868                 return 0;
 869
 870         /* Check for backlog size */
 871         if (sk_acceptq_is_full(parent)) {
 872                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 873                 goto done;
 874         }
 875
 876         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 877         if (!sk)
 878                 goto done;
 879
 880         rfcomm_sock_init(sk, parent);
 881         bacpy(&bt_sk(sk)->src, &src);
 882         bacpy(&bt_sk(sk)->dst, &dst);
 883         rfcomm_pi(sk)->channel = channel;
 884
 885         sk->sk_state = BT_CONFIG;
 886         bt_accept_enqueue(parent, sk);
 887
 888         /* Accept connection and return socket DLC */
 889         *d = rfcomm_pi(sk)->dlc;
 890         result = 1;
 891
 892 done:
 893         bh_unlock_sock(parent);
 894         return result;
 895 }
 896
 897 static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
 898 {
 899         struct sock *sk;
 900         struct hlist_node *node;
 901         char *str = buf;
 902
 903         read_lock_bh(&rfcomm_sk_list.lock);
 904
 905         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 906                 str += sprintf(str, "%s %s %d %d\n",
 907                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
 908                                 sk->sk_state, rfcomm_pi(sk)->channel);
 909         }
 910
 911         read_unlock_bh(&rfcomm_sk_list.lock);
 912
 913         return (str - buf);
 914 }
 915
 916 static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
 917
 918 static const struct proto_ops rfcomm_sock_ops = {
 919         .family         = PF_BLUETOOTH,
 920         .owner          = THIS_MODULE,
 921         .release        = rfcomm_sock_release,
 922         .bind           = rfcomm_sock_bind,
 923         .connect        = rfcomm_sock_connect,
 924         .listen         = rfcomm_sock_listen,
 925         .accept         = rfcomm_sock_accept,
 926         .getname        = rfcomm_sock_getname,
 927         .sendmsg        = rfcomm_sock_sendmsg,
 928         .recvmsg        = rfcomm_sock_recvmsg,
 929         .shutdown       = rfcomm_sock_shutdown,
 930         .setsockopt     = rfcomm_sock_setsockopt,
 931         .getsockopt     = rfcomm_sock_getsockopt,
 932         .ioctl          = rfcomm_sock_ioctl,
 933         .poll           = bt_sock_poll,
 934         .socketpair     = sock_no_socketpair,
 935         .mmap           = sock_no_mmap
 936 };
 937
 938 static struct net_proto_family rfcomm_sock_family_ops = {
 939         .family         = PF_BLUETOOTH,
 940         .owner          = THIS_MODULE,
 941         .create         = rfcomm_sock_create
 942 };
 943
 944 int __init rfcomm_init_sockets(void)
 945 {
 946         int err;
 947
 948         err = proto_register(&rfcomm_proto, 0);
 949         if (err < 0)
 950                 return err;
 951
 952         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
 953         if (err < 0)
 954                 goto error;
 955
 956         if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
 957                 BT_ERR("Failed to create RFCOMM info file");
 958
 959         BT_INFO("RFCOMM socket layer initialized");
 960
 961         return 0;
 962
 963 error:
 964         BT_ERR("RFCOMM socket layer registration failed");
 965         proto_unregister(&rfcomm_proto);
 966         return err;
 967 }
 968
 969 void __exit rfcomm_cleanup_sockets(void)
 970 {
 971         class_remove_file(bt_class, &class_attr_rfcomm);
 972
 973         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
 974                 BT_ERR("RFCOMM socket layer unregistration failed");
 975
 976         proto_unregister(&rfcomm_proto);
 977 }