Bluetooth: Fix RFCOMM usage of in-kernel L2CAP sockets
[safe/jmp/linux-2.6] / net / bluetooth / rfcomm / core.c
index bb72207..1d0fb0f 100644 (file)
@@ -23,8 +23,6 @@
 
 /*
  * Bluetooth RFCOMM core.
- *
- * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  */
 
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/init.h>
-#include <linux/freezer.h>
 #include <linux/wait.h>
 #include <linux/device.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
+#include <linux/kthread.h>
 
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/rfcomm.h>
 
-#ifndef CONFIG_BT_RFCOMM_DEBUG
-#undef  BT_DBG
-#define BT_DBG(D...)
-#endif
-
-#define VERSION "1.8"
+#define VERSION "1.11"
 
 static int disable_cfc = 0;
 static int channel_mtu = -1;
@@ -68,7 +61,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 static unsigned long rfcomm_event;
 
 static LIST_HEAD(session_list);
-static atomic_t terminate, running;
 
 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
@@ -231,6 +223,27 @@ static int rfcomm_l2sock_create(struct socket **sock)
        return err;
 }
 
+static inline int rfcomm_check_security(struct rfcomm_dlc *d)
+{
+       struct sock *sk = d->session->sock->sk;
+       __u8 auth_type;
+
+       switch (d->sec_level) {
+       case BT_SECURITY_HIGH:
+               auth_type = HCI_AT_GENERAL_BONDING_MITM;
+               break;
+       case BT_SECURITY_MEDIUM:
+               auth_type = HCI_AT_GENERAL_BONDING;
+               break;
+       default:
+               auth_type = HCI_AT_NO_BONDING;
+               break;
+       }
+
+       return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
+                                                               auth_type);
+}
+
 /* ---- RFCOMM DLCs ---- */
 static void rfcomm_dlc_timeout(unsigned long arg)
 {
@@ -280,9 +293,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
        if (!d)
                return NULL;
 
-       init_timer(&d->timer);
-       d->timer.function = rfcomm_dlc_timeout;
-       d->timer.data = (unsigned long) d;
+       setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 
        skb_queue_head_init(&d->tx_queue);
        spin_lock_init(&d->lock);
@@ -374,15 +385,23 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
        d->addr     = __addr(s->initiator, dlci);
        d->priority = 7;
 
-       d->state    = BT_CONFIG;
+       d->state = BT_CONFIG;
        rfcomm_dlc_link(s, d);
 
+       d->out = 1;
+
        d->mtu = s->mtu;
        d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 
-       if (s->state == BT_CONNECTED)
-               rfcomm_send_pn(s, 1, d);
+       if (s->state == BT_CONNECTED) {
+               if (rfcomm_check_security(d))
+                       rfcomm_send_pn(s, 1, d);
+               else
+                       set_bit(RFCOMM_AUTH_PENDING, &d->flags);
+       }
+
        rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
+
        return 0;
 }
 
@@ -408,9 +427,16 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                        d, d->state, d->dlci, err, s);
 
        switch (d->state) {
-       case BT_CONNECTED:
-       case BT_CONFIG:
        case BT_CONNECT:
+       case BT_CONFIG:
+               if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
+                       set_bit(RFCOMM_AUTH_REJECT, &d->flags);
+                       rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                       break;
+               }
+               /* Fall through */
+
+       case BT_CONNECTED:
                d->state = BT_DISCONN;
                if (skb_queue_empty(&d->tx_queue)) {
                        rfcomm_send_disc(s, d->dlci);
@@ -421,6 +447,15 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                }
                break;
 
+       case BT_OPEN:
+       case BT_CONNECT2:
+               if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
+                       set_bit(RFCOMM_AUTH_REJECT, &d->flags);
+                       rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                       break;
+               }
+               /* Fall through */
+
        default:
                rfcomm_dlc_clear_timer(d);
 
@@ -468,7 +503,7 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
        return len;
 }
 
-void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
+void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 {
        BT_DBG("dlc %p state %ld", d, d->state);
 
@@ -479,7 +514,7 @@ void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
        rfcomm_schedule(RFCOMM_SCHED_TX);
 }
 
-void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
+void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 {
        BT_DBG("dlc %p state %ld", d, d->state);
 
@@ -623,6 +658,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
        bacpy(&addr.l2_bdaddr, src);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = 0;
+       addr.l2_cid    = 0;
        *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (*err < 0)
                goto failed;
@@ -644,6 +680,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
        bacpy(&addr.l2_bdaddr, dst);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = htobs(RFCOMM_PSM);
+       addr.l2_cid    = 0;
        *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
        if (*err == 0 || *err == -EINPROGRESS)
                return s;
@@ -1149,22 +1186,7 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
        return 0;
 }
 
-static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
-{
-       struct sock *sk = d->session->sock->sk;
-
-       if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
-               if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
-                       return 1;
-       } else if (d->link_mode & RFCOMM_LM_AUTH) {
-               if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
-                       return 1;
-       }
-
-       return 0;
-}
-
-static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
+void rfcomm_dlc_accept(struct rfcomm_dlc *d)
 {
        struct sock *sk = d->session->sock->sk;
 
@@ -1177,12 +1199,31 @@ static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
        d->state_change(d, 0);
        rfcomm_dlc_unlock(d);
 
-       if (d->link_mode & RFCOMM_LM_MASTER)
+       if (d->role_switch)
                hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
 
        rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
 }
 
+static void rfcomm_check_accept(struct rfcomm_dlc *d)
+{
+       if (rfcomm_check_security(d)) {
+               if (d->defer_setup) {
+                       set_bit(RFCOMM_DEFER_SETUP, &d->flags);
+                       rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+
+                       rfcomm_dlc_lock(d);
+                       d->state = BT_CONNECT2;
+                       d->state_change(d, 0);
+                       rfcomm_dlc_unlock(d);
+               } else
+                       rfcomm_dlc_accept(d);
+       } else {
+               set_bit(RFCOMM_AUTH_PENDING, &d->flags);
+               rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+       }
+}
+
 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
 {
        struct rfcomm_dlc *d;
@@ -1205,13 +1246,7 @@ static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
        if (d) {
                if (d->state == BT_OPEN) {
                        /* DLC was previously opened by PN request */
-                       if (rfcomm_check_link_mode(d)) {
-                               set_bit(RFCOMM_AUTH_PENDING, &d->flags);
-                               rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
-                               return 0;
-                       }
-
-                       rfcomm_dlc_accept(d);
+                       rfcomm_check_accept(d);
                }
                return 0;
        }
@@ -1223,13 +1258,7 @@ static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
                d->addr = __addr(s->initiator, dlci);
                rfcomm_dlc_link(s, d);
 
-               if (rfcomm_check_link_mode(d)) {
-                       set_bit(RFCOMM_AUTH_PENDING, &d->flags);
-                       rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
-                       return 0;
-               }
-
-               rfcomm_dlc_accept(d);
+               rfcomm_check_accept(d);
        } else {
                rfcomm_send_dm(s, dlci);
        }
@@ -1462,8 +1491,12 @@ static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb
                        clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
 
                rfcomm_dlc_lock(d);
+
+               d->remote_v24_sig = msc->v24_sig;
+
                if (d->modem_status)
                        d->modem_status(d, msc->v24_sig);
+
                rfcomm_dlc_unlock(d);
 
                rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
@@ -1639,7 +1672,12 @@ static void rfcomm_process_connect(struct rfcomm_session *s)
                d = list_entry(p, struct rfcomm_dlc, list);
                if (d->state == BT_CONFIG) {
                        d->mtu = s->mtu;
-                       rfcomm_send_pn(s, 1, d);
+                       if (rfcomm_check_security(d)) {
+                               rfcomm_send_pn(s, 1, d);
+                       } else {
+                               set_bit(RFCOMM_AUTH_PENDING, &d->flags);
+                               rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+                       }
                }
        }
 }
@@ -1712,24 +1750,40 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
 
                if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
                        rfcomm_dlc_clear_timer(d);
-                       rfcomm_dlc_accept(d);
-                       if (d->link_mode & RFCOMM_LM_SECURE) {
-                               struct sock *sk = s->sock->sk;
-                               hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
+                       if (d->out) {
+                               rfcomm_send_pn(s, 1, d);
+                               rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
+                       } else {
+                               if (d->defer_setup) {
+                                       set_bit(RFCOMM_DEFER_SETUP, &d->flags);
+                                       rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+
+                                       rfcomm_dlc_lock(d);
+                                       d->state = BT_CONNECT2;
+                                       d->state_change(d, 0);
+                                       rfcomm_dlc_unlock(d);
+                               } else
+                                       rfcomm_dlc_accept(d);
                        }
                        continue;
                } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
                        rfcomm_dlc_clear_timer(d);
-                       rfcomm_send_dm(s, d->dlci);
+                       if (!d->out)
+                               rfcomm_send_dm(s, d->dlci);
+                       else
+                               d->state = BT_CLOSED;
                        __rfcomm_dlc_close(d, ECONNREFUSED);
                        continue;
                }
 
+               if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
+                       continue;
+
                if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
                        continue;
 
                if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
-                               d->mscex == RFCOMM_MSCEX_OK)
+                                               d->mscex == RFCOMM_MSCEX_OK)
                        rfcomm_process_tx(d);
        }
 }
@@ -1772,8 +1826,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
        if (err < 0)
                return;
 
-       __module_get(nsock->ops->owner);
-
        /* Set our callbacks */
        nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
        nsock->sk->sk_state_change = rfcomm_l2state_change;
@@ -1850,26 +1902,6 @@ static inline void rfcomm_process_sessions(void)
        rfcomm_unlock();
 }
 
-static void rfcomm_worker(void)
-{
-       BT_DBG("");
-
-       while (!atomic_read(&terminate)) {
-               set_current_state(TASK_INTERRUPTIBLE);
-               if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                       /* No pending events. Let's sleep.
-                        * Incoming connections and data will wake us up. */
-                       schedule();
-               }
-               set_current_state(TASK_RUNNING);
-
-               /* Process stuff */
-               clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
-               rfcomm_process_sessions();
-       }
-       return;
-}
-
 static int rfcomm_add_listener(bdaddr_t *ba)
 {
        struct sockaddr_l2 addr;
@@ -1889,6 +1921,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
        bacpy(&addr.l2_bdaddr, ba);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = htobs(RFCOMM_PSM);
+       addr.l2_cid    = 0;
        err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (err < 0) {
                BT_ERR("Bind failed %d", err);
@@ -1935,32 +1968,38 @@ static void rfcomm_kill_listener(void)
 
 static int rfcomm_run(void *unused)
 {
-       rfcomm_thread = current;
-
-       atomic_inc(&running);
+       BT_DBG("");
 
-       daemonize("krfcommd");
        set_user_nice(current, -10);
 
-       BT_DBG("");
-
        rfcomm_add_listener(BDADDR_ANY);
 
-       rfcomm_worker();
+       while (!kthread_should_stop()) {
+               set_current_state(TASK_INTERRUPTIBLE);
+               if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
+                       /* No pending events. Let's sleep.
+                        * Incoming connections and data will wake us up. */
+                       schedule();
+               }
+               set_current_state(TASK_RUNNING);
+
+               /* Process stuff */
+               clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
+               rfcomm_process_sessions();
+       }
 
        rfcomm_kill_listener();
 
-       atomic_dec(&running);
        return 0;
 }
 
-static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
+static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 {
        struct rfcomm_session *s;
        struct rfcomm_dlc *d;
        struct list_head *p, *n;
 
-       BT_DBG("conn %p status 0x%02x", conn, status);
+       BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
 
        s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
        if (!s)
@@ -1971,44 +2010,29 @@ static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
        list_for_each_safe(p, n, &s->dlcs) {
                d = list_entry(p, struct rfcomm_dlc, list);
 
-               if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
-                       continue;
-
-               if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
-                       continue;
-
-               if (!status)
-                       set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
-               else
-                       set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-       }
-
-       rfcomm_session_put(s);
-
-       rfcomm_schedule(RFCOMM_SCHED_AUTH);
-}
-
-static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
-{
-       struct rfcomm_session *s;
-       struct rfcomm_dlc *d;
-       struct list_head *p, *n;
-
-       BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
-
-       s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
-       if (!s)
-               return;
-
-       rfcomm_session_hold(s);
+               if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
+                       rfcomm_dlc_clear_timer(d);
+                       if (status || encrypt == 0x00) {
+                               __rfcomm_dlc_close(d, ECONNREFUSED);
+                               continue;
+                       }
+               }
 
-       list_for_each_safe(p, n, &s->dlcs) {
-               d = list_entry(p, struct rfcomm_dlc, list);
+               if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
+                       if (d->sec_level == BT_SECURITY_MEDIUM) {
+                               set_bit(RFCOMM_SEC_PENDING, &d->flags);
+                               rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+                               continue;
+                       } else if (d->sec_level == BT_SECURITY_HIGH) {
+                               __rfcomm_dlc_close(d, ECONNREFUSED);
+                               continue;
+                       }
+               }
 
                if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
                        continue;
 
-               if (!status && encrypt)
+               if (!status)
                        set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
                else
                        set_bit(RFCOMM_AUTH_REJECT, &d->flags);
@@ -2021,8 +2045,7 @@ static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 
 static struct hci_cb rfcomm_cb = {
        .name           = "RFCOMM",
-       .auth_cfm       = rfcomm_auth_cfm,
-       .encrypt_cfm    = rfcomm_encrypt_cfm
+       .security_cfm   = rfcomm_security_cfm
 };
 
 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
@@ -2059,7 +2082,11 @@ static int __init rfcomm_init(void)
 
        hci_register_cb(&rfcomm_cb);
 
-       kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
+       rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
+       if (IS_ERR(rfcomm_thread)) {
+               hci_unregister_cb(&rfcomm_cb);
+               return PTR_ERR(rfcomm_thread);
+       }
 
        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                BT_ERR("Failed to create RFCOMM info file");
@@ -2081,14 +2108,7 @@ static void __exit rfcomm_exit(void)
 
        hci_unregister_cb(&rfcomm_cb);
 
-       /* Terminate working thread.
-        * ie. Set terminate flag and wake it up */
-       atomic_inc(&terminate);
-       rfcomm_schedule(RFCOMM_SCHED_STATE);
-
-       /* Wait until thread is running */
-       while (atomic_read(&running))
-               schedule();
+       kthread_stop(rfcomm_thread);
 
 #ifdef CONFIG_BT_RFCOMM_TTY
        rfcomm_cleanup_ttys();
@@ -2109,7 +2129,7 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 module_param(l2cap_mtu, uint, 0644);
 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");