net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/rfcomm.h>
  35
  36 static const struct proto_ops rfcomm_sock_ops;
  37
  38 static struct bt_sock_list rfcomm_sk_list = {
  39         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  40 };
  41
  42 static void rfcomm_sock_close(struct sock *sk);
  43 static void rfcomm_sock_kill(struct sock *sk);
  44
  45 /* ---- DLC callbacks ----
  46  *
  47  * called under rfcomm_dlc_lock()
  48  */
  49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  50 {
  51         struct sock *sk = d->owner;
  52         if (!sk)
  53                 return;
  54
  55         atomic_add(skb->len, &sk->sk_rmem_alloc);
  56         skb_queue_tail(&sk->sk_receive_queue, skb);
  57         sk->sk_data_ready(sk, skb->len);
  58
  59         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  60                 rfcomm_dlc_throttle(d);
  61 }
  62
  63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  64 {
  65         struct sock *sk = d->owner, *parent;
  66         unsigned long flags;
  67
  68         if (!sk)
  69                 return;
  70
  71         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  72
  73         local_irq_save(flags);
  74         bh_lock_sock(sk);
  75
  76         if (err)
  77                 sk->sk_err = err;
  78
  79         sk->sk_state = d->state;
  80
  81         parent = bt_sk(sk)->parent;
  82         if (parent) {
  83                 if (d->state == BT_CLOSED) {
  84                         sock_set_flag(sk, SOCK_ZAPPED);
  85                         bt_accept_unlink(sk);
  86                 }
  87                 parent->sk_data_ready(parent, 0);
  88         } else {
  89                 if (d->state == BT_CONNECTED)
  90                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
  91                 sk->sk_state_change(sk);
  92         }
  93
  94         bh_unlock_sock(sk);
  95         local_irq_restore(flags);
  96
  97         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
  98                 /* We have to drop DLC lock here, otherwise
  99                  * rfcomm_sock_destruct() will dead lock. */
 100                 rfcomm_dlc_unlock(d);
 101                 rfcomm_sock_kill(sk);
 102                 rfcomm_dlc_lock(d);
 103         }
 104 }
 105
 106 /* ---- Socket functions ---- */
 107 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 108 {
 109         struct sock *sk = NULL;
 110
 111         sk_for_each(sk, &rfcomm_sk_list.head) {
 112                 if (rfcomm_pi(sk)->channel == channel &&
 113                                 !bacmp(&bt_sk(sk)->src, src))
 114                         break;
 115         }
 116
 117         return sk ? sk : NULL;
 118 }
 119
 120 /* Find socket with channel and source bdaddr.
 121  * Returns closest match.
 122  */
 123 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 124 {
 125         struct sock *sk = NULL, *sk1 = NULL;
 126
 127         read_lock(&rfcomm_sk_list.lock);
 128
 129         sk_for_each(sk, &rfcomm_sk_list.head) {
 130                 if (state && sk->sk_state != state)
 131                         continue;
 132
 133                 if (rfcomm_pi(sk)->channel == channel) {
 134                         /* Exact match. */
 135                         if (!bacmp(&bt_sk(sk)->src, src))
 136                                 break;
 137
 138                         /* Closest match */
 139                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 140                                 sk1 = sk;
 141                 }
 142         }
 143
 144         read_unlock(&rfcomm_sk_list.lock);
 145
 146         return sk ? sk : sk1;
 147 }
 148
 149 static void rfcomm_sock_destruct(struct sock *sk)
 150 {
 151         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 152
 153         BT_DBG("sk %p dlc %p", sk, d);
 154
 155         skb_queue_purge(&sk->sk_receive_queue);
 156         skb_queue_purge(&sk->sk_write_queue);
 157
 158         rfcomm_dlc_lock(d);
 159         rfcomm_pi(sk)->dlc = NULL;
 160
 161         /* Detach DLC if it's owned by this socket */
 162         if (d->owner == sk)
 163                 d->owner = NULL;
 164         rfcomm_dlc_unlock(d);
 165
 166         rfcomm_dlc_put(d);
 167 }
 168
 169 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 170 {
 171         struct sock *sk;
 172
 173         BT_DBG("parent %p", parent);
 174
 175         /* Close not yet accepted dlcs */
 176         while ((sk = bt_accept_dequeue(parent, NULL))) {
 177                 rfcomm_sock_close(sk);
 178                 rfcomm_sock_kill(sk);
 179         }
 180
 181         parent->sk_state  = BT_CLOSED;
 182         sock_set_flag(parent, SOCK_ZAPPED);
 183 }
 184
 185 /* Kill socket (only if zapped and orphan)
 186  * Must be called on unlocked socket.
 187  */
 188 static void rfcomm_sock_kill(struct sock *sk)
 189 {
 190         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 191                 return;
 192
 193         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 194
 195         /* Kill poor orphan */
 196         bt_sock_unlink(&rfcomm_sk_list, sk);
 197         sock_set_flag(sk, SOCK_DEAD);
 198         sock_put(sk);
 199 }
 200
 201 static void __rfcomm_sock_close(struct sock *sk)
 202 {
 203         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 204
 205         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 206
 207         switch (sk->sk_state) {
 208         case BT_LISTEN:
 209                 rfcomm_sock_cleanup_listen(sk);
 210                 break;
 211
 212         case BT_CONNECT:
 213         case BT_CONNECT2:
 214         case BT_CONFIG:
 215         case BT_CONNECTED:
 216                 rfcomm_dlc_close(d, 0);
 217
 218         default:
 219                 sock_set_flag(sk, SOCK_ZAPPED);
 220                 break;
 221         }
 222 }
 223
 224 /* Close socket.
 225  * Must be called on unlocked socket.
 226  */
 227 static void rfcomm_sock_close(struct sock *sk)
 228 {
 229         lock_sock(sk);
 230         __rfcomm_sock_close(sk);
 231         release_sock(sk);
 232 }
 233
 234 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 235 {
 236         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 237
 238         BT_DBG("sk %p", sk);
 239
 240         if (parent) {
 241                 sk->sk_type = parent->sk_type;
 242                 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
 243                                                 &bt_sk(parent)->flags);
 244
 245                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 246                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 247
 248                 security_sk_clone(parent, sk);
 249         } else {
 250                 pi->dlc->defer_setup = 0;
 251
 252                 pi->sec_level = BT_SECURITY_LOW;
 253                 pi->role_switch = 0;
 254         }
 255
 256         pi->dlc->sec_level = pi->sec_level;
 257         pi->dlc->role_switch = pi->role_switch;
 258 }
 259
 260 static struct proto rfcomm_proto = {
 261         .name           = "RFCOMM",
 262         .owner          = THIS_MODULE,
 263         .obj_size       = sizeof(struct rfcomm_pinfo)
 264 };
 265
 266 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 267 {
 268         struct rfcomm_dlc *d;
 269         struct sock *sk;
 270
 271         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 272         if (!sk)
 273                 return NULL;
 274
 275         sock_init_data(sock, sk);
 276         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 277
 278         d = rfcomm_dlc_alloc(prio);
 279         if (!d) {
 280                 sk_free(sk);
 281                 return NULL;
 282         }
 283
 284         d->data_ready   = rfcomm_sk_data_ready;
 285         d->state_change = rfcomm_sk_state_change;
 286
 287         rfcomm_pi(sk)->dlc = d;
 288         d->owner = sk;
 289
 290         sk->sk_destruct = rfcomm_sock_destruct;
 291         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 292
 293         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 294         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 295
 296         sock_reset_flag(sk, SOCK_ZAPPED);
 297
 298         sk->sk_protocol = proto;
 299         sk->sk_state    = BT_OPEN;
 300
 301         bt_sock_link(&rfcomm_sk_list, sk);
 302
 303         BT_DBG("sk %p", sk);
 304         return sk;
 305 }
 306
 307 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 308                               int protocol, int kern)
 309 {
 310         struct sock *sk;
 311
 312         BT_DBG("sock %p", sock);
 313
 314         sock->state = SS_UNCONNECTED;
 315
 316         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 317                 return -ESOCKTNOSUPPORT;
 318
 319         sock->ops = &rfcomm_sock_ops;
 320
 321         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 322         if (!sk)
 323                 return -ENOMEM;
 324
 325         rfcomm_sock_init(sk, NULL);
 326         return 0;
 327 }
 328
 329 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 330 {
 331         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 332         struct sock *sk = sock->sk;
 333         int err = 0;
 334
 335         BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr);
 336
 337         if (!addr || addr->sa_family != AF_BLUETOOTH)
 338                 return -EINVAL;
 339
 340         lock_sock(sk);
 341
 342         if (sk->sk_state != BT_OPEN) {
 343                 err = -EBADFD;
 344                 goto done;
 345         }
 346
 347         if (sk->sk_type != SOCK_STREAM) {
 348                 err = -EINVAL;
 349                 goto done;
 350         }
 351
 352         write_lock(&rfcomm_sk_list.lock);
 353
 354         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 355                 err = -EADDRINUSE;
 356         } else {
 357                 /* Save source address */
 358                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 359                 rfcomm_pi(sk)->channel = sa->rc_channel;
 360                 sk->sk_state = BT_BOUND;
 361         }
 362
 363         write_unlock(&rfcomm_sk_list.lock);
 364
 365 done:
 366         release_sock(sk);
 367         return err;
 368 }
 369
 370 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 371 {
 372         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 373         struct sock *sk = sock->sk;
 374         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 375         int err = 0;
 376
 377         BT_DBG("sk %p", sk);
 378
 379         if (alen < sizeof(struct sockaddr_rc) ||
 380             addr->sa_family != AF_BLUETOOTH)
 381                 return -EINVAL;
 382
 383         lock_sock(sk);
 384
 385         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 386                 err = -EBADFD;
 387                 goto done;
 388         }
 389
 390         if (sk->sk_type != SOCK_STREAM) {
 391                 err = -EINVAL;
 392                 goto done;
 393         }
 394
 395         sk->sk_state = BT_CONNECT;
 396         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 397         rfcomm_pi(sk)->channel = sa->rc_channel;
 398
 399         d->sec_level = rfcomm_pi(sk)->sec_level;
 400         d->role_switch = rfcomm_pi(sk)->role_switch;
 401
 402         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 403         if (!err)
 404                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 405                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 406
 407 done:
 408         release_sock(sk);
 409         return err;
 410 }
 411
 412 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 413 {
 414         struct sock *sk = sock->sk;
 415         int err = 0;
 416
 417         BT_DBG("sk %p backlog %d", sk, backlog);
 418
 419         lock_sock(sk);
 420
 421         if (sk->sk_state != BT_BOUND) {
 422                 err = -EBADFD;
 423                 goto done;
 424         }
 425
 426         if (sk->sk_type != SOCK_STREAM) {
 427                 err = -EINVAL;
 428                 goto done;
 429         }
 430
 431         if (!rfcomm_pi(sk)->channel) {
 432                 bdaddr_t *src = &bt_sk(sk)->src;
 433                 u8 channel;
 434
 435                 err = -EINVAL;
 436
 437                 write_lock(&rfcomm_sk_list.lock);
 438
 439                 for (channel = 1; channel < 31; channel++)
 440                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 441                                 rfcomm_pi(sk)->channel = channel;
 442                                 err = 0;
 443                                 break;
 444                         }
 445
 446                 write_unlock(&rfcomm_sk_list.lock);
 447
 448                 if (err < 0)
 449                         goto done;
 450         }
 451
 452         sk->sk_max_ack_backlog = backlog;
 453         sk->sk_ack_backlog = 0;
 454         sk->sk_state = BT_LISTEN;
 455
 456 done:
 457         release_sock(sk);
 458         return err;
 459 }
 460
 461 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 462 {
 463         DECLARE_WAITQUEUE(wait, current);
 464         struct sock *sk = sock->sk, *nsk;
 465         long timeo;
 466         int err = 0;
 467
 468         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 469
 470         if (sk->sk_type != SOCK_STREAM) {
 471                 err = -EINVAL;
 472                 goto done;
 473         }
 474
 475         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 476
 477         BT_DBG("sk %p timeo %ld", sk, timeo);
 478
 479         /* Wait for an incoming connection. (wake-one). */
 480         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 481         while (1) {
 482                 set_current_state(TASK_INTERRUPTIBLE);
 483
 484                 if (sk->sk_state != BT_LISTEN) {
 485                         err = -EBADFD;
 486                         break;
 487                 }
 488
 489                 nsk = bt_accept_dequeue(sk, newsock);
 490                 if (nsk)
 491                         break;
 492
 493                 if (!timeo) {
 494                         err = -EAGAIN;
 495                         break;
 496                 }
 497
 498                 if (signal_pending(current)) {
 499                         err = sock_intr_errno(timeo);
 500                         break;
 501                 }
 502
 503                 release_sock(sk);
 504                 timeo = schedule_timeout(timeo);
 505                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 506         }
 507         __set_current_state(TASK_RUNNING);
 508         remove_wait_queue(sk_sleep(sk), &wait);
 509
 510         if (err)
 511                 goto done;
 512
 513         newsock->state = SS_CONNECTED;
 514
 515         BT_DBG("new socket %p", nsk);
 516
 517 done:
 518         release_sock(sk);
 519         return err;
 520 }
 521
 522 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 523 {
 524         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 525         struct sock *sk = sock->sk;
 526
 527         BT_DBG("sock %p, sk %p", sock, sk);
 528
 529         memset(sa, 0, sizeof(*sa));
 530         sa->rc_family  = AF_BLUETOOTH;
 531         sa->rc_channel = rfcomm_pi(sk)->channel;
 532         if (peer)
 533                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 534         else
 535                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 536
 537         *len = sizeof(struct sockaddr_rc);
 538         return 0;
 539 }
 540
 541 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 542                                struct msghdr *msg, size_t len)
 543 {
 544         struct sock *sk = sock->sk;
 545         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 546         struct sk_buff *skb;
 547         int sent;
 548
 549         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 550                 return -ENOTCONN;
 551
 552         if (msg->msg_flags & MSG_OOB)
 553                 return -EOPNOTSUPP;
 554
 555         if (sk->sk_shutdown & SEND_SHUTDOWN)
 556                 return -EPIPE;
 557
 558         BT_DBG("sock %p, sk %p", sock, sk);
 559
 560         lock_sock(sk);
 561
 562         sent = bt_sock_wait_ready(sk, msg->msg_flags);
 563         if (sent)
 564                 goto done;
 565
 566         while (len) {
 567                 size_t size = min_t(size_t, len, d->mtu);
 568                 int err;
 569
 570                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 571                                 msg->msg_flags & MSG_DONTWAIT, &err);
 572                 if (!skb) {
 573                         if (sent == 0)
 574                                 sent = err;
 575                         break;
 576                 }
 577                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 578
 579                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 580                 if (err) {
 581                         kfree_skb(skb);
 582                         if (sent == 0)
 583                                 sent = err;
 584                         break;
 585                 }
 586
 587                 skb->priority = sk->sk_priority;
 588
 589                 err = rfcomm_dlc_send(d, skb);
 590                 if (err < 0) {
 591                         kfree_skb(skb);
 592                         if (sent == 0)
 593                                 sent = err;
 594                         break;
 595                 }
 596
 597                 sent += size;
 598                 len  -= size;
 599         }
 600
 601 done:
 602         release_sock(sk);
 603
 604         return sent;
 605 }
 606
 607 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 608                                struct msghdr *msg, size_t size, int flags)
 609 {
 610         struct sock *sk = sock->sk;
 611         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 612         int len;
 613
 614         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 615                 rfcomm_dlc_accept(d);
 616                 msg->msg_namelen = 0;
 617                 return 0;
 618         }
 619
 620         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 621
 622         lock_sock(sk);
 623         if (!(flags & MSG_PEEK) && len > 0)
 624                 atomic_sub(len, &sk->sk_rmem_alloc);
 625
 626         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 627                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 628         release_sock(sk);
 629
 630         return len;
 631 }
 632
 633 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 634 {
 635         struct sock *sk = sock->sk;
 636         int err = 0;
 637         u32 opt;
 638
 639         BT_DBG("sk %p", sk);
 640
 641         lock_sock(sk);
 642
 643         switch (optname) {
 644         case RFCOMM_LM:
 645                 if (get_user(opt, (u32 __user *) optval)) {
 646                         err = -EFAULT;
 647                         break;
 648                 }
 649
 650                 if (opt & RFCOMM_LM_AUTH)
 651                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 652                 if (opt & RFCOMM_LM_ENCRYPT)
 653                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 654                 if (opt & RFCOMM_LM_SECURE)
 655                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 656
 657                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 658                 break;
 659
 660         default:
 661                 err = -ENOPROTOOPT;
 662                 break;
 663         }
 664
 665         release_sock(sk);
 666         return err;
 667 }
 668
 669 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 670 {
 671         struct sock *sk = sock->sk;
 672         struct bt_security sec;
 673         int err = 0;
 674         size_t len;
 675         u32 opt;
 676
 677         BT_DBG("sk %p", sk);
 678
 679         if (level == SOL_RFCOMM)
 680                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 681
 682         if (level != SOL_BLUETOOTH)
 683                 return -ENOPROTOOPT;
 684
 685         lock_sock(sk);
 686
 687         switch (optname) {
 688         case BT_SECURITY:
 689                 if (sk->sk_type != SOCK_STREAM) {
 690                         err = -EINVAL;
 691                         break;
 692                 }
 693
 694                 sec.level = BT_SECURITY_LOW;
 695
 696                 len = min_t(unsigned int, sizeof(sec), optlen);
 697                 if (copy_from_user((char *) &sec, optval, len)) {
 698                         err = -EFAULT;
 699                         break;
 700                 }
 701
 702                 if (sec.level > BT_SECURITY_HIGH) {
 703                         err = -EINVAL;
 704                         break;
 705                 }
 706
 707                 rfcomm_pi(sk)->sec_level = sec.level;
 708                 break;
 709
 710         case BT_DEFER_SETUP:
 711                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 712                         err = -EINVAL;
 713                         break;
 714                 }
 715
 716                 if (get_user(opt, (u32 __user *) optval)) {
 717                         err = -EFAULT;
 718                         break;
 719                 }
 720
 721                 if (opt)
 722                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 723                 else
 724                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 725
 726                 break;
 727
 728         default:
 729                 err = -ENOPROTOOPT;
 730                 break;
 731         }
 732
 733         release_sock(sk);
 734         return err;
 735 }
 736
 737 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 738 {
 739         struct sock *sk = sock->sk;
 740         struct rfcomm_conninfo cinfo;
 741         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 742         int len, err = 0;
 743         u32 opt;
 744
 745         BT_DBG("sk %p", sk);
 746
 747         if (get_user(len, optlen))
 748                 return -EFAULT;
 749
 750         lock_sock(sk);
 751
 752         switch (optname) {
 753         case RFCOMM_LM:
 754                 switch (rfcomm_pi(sk)->sec_level) {
 755                 case BT_SECURITY_LOW:
 756                         opt = RFCOMM_LM_AUTH;
 757                         break;
 758                 case BT_SECURITY_MEDIUM:
 759                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 760                         break;
 761                 case BT_SECURITY_HIGH:
 762                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 763                                                         RFCOMM_LM_SECURE;
 764                         break;
 765                 default:
 766                         opt = 0;
 767                         break;
 768                 }
 769
 770                 if (rfcomm_pi(sk)->role_switch)
 771                         opt |= RFCOMM_LM_MASTER;
 772
 773                 if (put_user(opt, (u32 __user *) optval))
 774                         err = -EFAULT;
 775                 break;
 776
 777         case RFCOMM_CONNINFO:
 778                 if (sk->sk_state != BT_CONNECTED &&
 779                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 780                         err = -ENOTCONN;
 781                         break;
 782                 }
 783
 784                 memset(&cinfo, 0, sizeof(cinfo));
 785                 cinfo.hci_handle = conn->hcon->handle;
 786                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 787
 788                 len = min_t(unsigned int, len, sizeof(cinfo));
 789                 if (copy_to_user(optval, (char *) &cinfo, len))
 790                         err = -EFAULT;
 791
 792                 break;
 793
 794         default:
 795                 err = -ENOPROTOOPT;
 796                 break;
 797         }
 798
 799         release_sock(sk);
 800         return err;
 801 }
 802
 803 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 804 {
 805         struct sock *sk = sock->sk;
 806         struct bt_security sec;
 807         int len, err = 0;
 808
 809         BT_DBG("sk %p", sk);
 810
 811         if (level == SOL_RFCOMM)
 812                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 813
 814         if (level != SOL_BLUETOOTH)
 815                 return -ENOPROTOOPT;
 816
 817         if (get_user(len, optlen))
 818                 return -EFAULT;
 819
 820         lock_sock(sk);
 821
 822         switch (optname) {
 823         case BT_SECURITY:
 824                 if (sk->sk_type != SOCK_STREAM) {
 825                         err = -EINVAL;
 826                         break;
 827                 }
 828
 829                 sec.level = rfcomm_pi(sk)->sec_level;
 830                 sec.key_size = 0;
 831
 832                 len = min_t(unsigned int, len, sizeof(sec));
 833                 if (copy_to_user(optval, (char *) &sec, len))
 834                         err = -EFAULT;
 835
 836                 break;
 837
 838         case BT_DEFER_SETUP:
 839                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 840                         err = -EINVAL;
 841                         break;
 842                 }
 843
 844                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 845                              (u32 __user *) optval))
 846                         err = -EFAULT;
 847
 848                 break;
 849
 850         default:
 851                 err = -ENOPROTOOPT;
 852                 break;
 853         }
 854
 855         release_sock(sk);
 856         return err;
 857 }
 858
 859 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 860 {
 861         struct sock *sk __maybe_unused = sock->sk;
 862         int err;
 863
 864         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 865
 866         err = bt_sock_ioctl(sock, cmd, arg);
 867
 868         if (err == -ENOIOCTLCMD) {
 869 #ifdef CONFIG_BT_RFCOMM_TTY
 870                 lock_sock(sk);
 871                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 872                 release_sock(sk);
 873 #else
 874                 err = -EOPNOTSUPP;
 875 #endif
 876         }
 877
 878         return err;
 879 }
 880
 881 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 882 {
 883         struct sock *sk = sock->sk;
 884         int err = 0;
 885
 886         BT_DBG("sock %p, sk %p", sock, sk);
 887
 888         if (!sk)
 889                 return 0;
 890
 891         lock_sock(sk);
 892         if (!sk->sk_shutdown) {
 893                 sk->sk_shutdown = SHUTDOWN_MASK;
 894                 __rfcomm_sock_close(sk);
 895
 896                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 897                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 898         }
 899         release_sock(sk);
 900         return err;
 901 }
 902
 903 static int rfcomm_sock_release(struct socket *sock)
 904 {
 905         struct sock *sk = sock->sk;
 906         int err;
 907
 908         BT_DBG("sock %p, sk %p", sock, sk);
 909
 910         if (!sk)
 911                 return 0;
 912
 913         err = rfcomm_sock_shutdown(sock, 2);
 914
 915         sock_orphan(sk);
 916         rfcomm_sock_kill(sk);
 917         return err;
 918 }
 919
 920 /* ---- RFCOMM core layer callbacks ----
 921  *
 922  * called under rfcomm_lock()
 923  */
 924 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 925 {
 926         struct sock *sk, *parent;
 927         bdaddr_t src, dst;
 928         int result = 0;
 929
 930         BT_DBG("session %p channel %d", s, channel);
 931
 932         rfcomm_session_getaddr(s, &src, &dst);
 933
 934         /* Check if we have socket listening on channel */
 935         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 936         if (!parent)
 937                 return 0;
 938
 939         bh_lock_sock(parent);
 940
 941         /* Check for backlog size */
 942         if (sk_acceptq_is_full(parent)) {
 943                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 944                 goto done;
 945         }
 946
 947         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 948         if (!sk)
 949                 goto done;
 950
 951         bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
 952
 953         rfcomm_sock_init(sk, parent);
 954         bacpy(&bt_sk(sk)->src, &src);
 955         bacpy(&bt_sk(sk)->dst, &dst);
 956         rfcomm_pi(sk)->channel = channel;
 957
 958         sk->sk_state = BT_CONFIG;
 959         bt_accept_enqueue(parent, sk);
 960
 961         /* Accept connection and return socket DLC */
 962         *d = rfcomm_pi(sk)->dlc;
 963         result = 1;
 964
 965 done:
 966         bh_unlock_sock(parent);
 967
 968         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 969                 parent->sk_state_change(parent);
 970
 971         return result;
 972 }
 973
 974 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 975 {
 976         struct sock *sk;
 977
 978         read_lock(&rfcomm_sk_list.lock);
 979
 980         sk_for_each(sk, &rfcomm_sk_list.head) {
 981                 seq_printf(f, "%pMR %pMR %d %d\n",
 982                            &bt_sk(sk)->src, &bt_sk(sk)->dst,
 983                            sk->sk_state, rfcomm_pi(sk)->channel);
 984         }
 985
 986         read_unlock(&rfcomm_sk_list.lock);
 987
 988         return 0;
 989 }
 990
 991 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
 992 {
 993         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
 994 }
 995
 996 static const struct file_operations rfcomm_sock_debugfs_fops = {
 997         .open           = rfcomm_sock_debugfs_open,
 998         .read           = seq_read,
 999         .llseek         = seq_lseek,
1000         .release        = single_release,
1001 };
1002
1003 static struct dentry *rfcomm_sock_debugfs;
1004
1005 static const struct proto_ops rfcomm_sock_ops = {
1006         .family         = PF_BLUETOOTH,
1007         .owner          = THIS_MODULE,
1008         .release        = rfcomm_sock_release,
1009         .bind           = rfcomm_sock_bind,
1010         .connect        = rfcomm_sock_connect,
1011         .listen         = rfcomm_sock_listen,
1012         .accept         = rfcomm_sock_accept,
1013         .getname        = rfcomm_sock_getname,
1014         .sendmsg        = rfcomm_sock_sendmsg,
1015         .recvmsg        = rfcomm_sock_recvmsg,
1016         .shutdown       = rfcomm_sock_shutdown,
1017         .setsockopt     = rfcomm_sock_setsockopt,
1018         .getsockopt     = rfcomm_sock_getsockopt,
1019         .ioctl          = rfcomm_sock_ioctl,
1020         .poll           = bt_sock_poll,
1021         .socketpair     = sock_no_socketpair,
1022         .mmap           = sock_no_mmap
1023 };
1024
1025 static const struct net_proto_family rfcomm_sock_family_ops = {
1026         .family         = PF_BLUETOOTH,
1027         .owner          = THIS_MODULE,
1028         .create         = rfcomm_sock_create
1029 };
1030
1031 int __init rfcomm_init_sockets(void)
1032 {
1033         int err;
1034
1035         err = proto_register(&rfcomm_proto, 0);
1036         if (err < 0)
1037                 return err;
1038
1039         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1040         if (err < 0) {
1041                 BT_ERR("RFCOMM socket layer registration failed");
1042                 goto error;
1043         }
1044
1045         err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1046         if (err < 0) {
1047                 BT_ERR("Failed to create RFCOMM proc file");
1048                 bt_sock_unregister(BTPROTO_RFCOMM);
1049                 goto error;
1050         }
1051
1052         if (bt_debugfs) {
1053                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1054                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1055                 if (!rfcomm_sock_debugfs)
1056                         BT_ERR("Failed to create RFCOMM debug file");
1057         }
1058
1059         BT_INFO("RFCOMM socket layer initialized");
1060
1061         return 0;
1062
1063 error:
1064         proto_unregister(&rfcomm_proto);
1065         return err;
1066 }
1067
1068 void __exit rfcomm_cleanup_sockets(void)
1069 {
1070         bt_procfs_cleanup(&init_net, "rfcomm");
1071
1072         debugfs_remove(rfcomm_sock_debugfs);
1073
1074         bt_sock_unregister(BTPROTO_RFCOMM);
1075
1076         proto_unregister(&rfcomm_proto);
1077 }