Showing error 1771

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: net/bluetooth/sco.c
Line in file: 220
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC


Source:

   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7   This program is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU General Public License version 2 as
   9   published by the Free Software Foundation;
  10
  11   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22   SOFTWARE IS DISCLAIMED.
  23*/
  24
  25/* Bluetooth SCO sockets. */
  26
  27#include <linux/module.h>
  28
  29#include <linux/types.h>
  30#include <linux/errno.h>
  31#include <linux/kernel.h>
  32#include <linux/sched.h>
  33#include <linux/slab.h>
  34#include <linux/poll.h>
  35#include <linux/fcntl.h>
  36#include <linux/init.h>
  37#include <linux/interrupt.h>
  38#include <linux/socket.h>
  39#include <linux/skbuff.h>
  40#include <linux/device.h>
  41#include <linux/list.h>
  42#include <net/sock.h>
  43
  44#include <asm/system.h>
  45#include <asm/uaccess.h>
  46
  47#include <net/bluetooth/bluetooth.h>
  48#include <net/bluetooth/hci_core.h>
  49#include <net/bluetooth/sco.h>
  50
  51#ifndef CONFIG_BT_SCO_DEBUG
  52#undef  BT_DBG
  53#define BT_DBG(D...)
  54#endif
  55
  56#define VERSION "0.6"
  57
  58static int disable_esco = 0;
  59
  60static const struct proto_ops sco_sock_ops;
  61
  62static struct bt_sock_list sco_sk_list = {
  63        .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  64};
  65
  66static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
  67static void sco_chan_del(struct sock *sk, int err);
  68
  69static int  sco_conn_del(struct hci_conn *conn, int err);
  70
  71static void sco_sock_close(struct sock *sk);
  72static void sco_sock_kill(struct sock *sk);
  73
  74/* ---- SCO timers ---- */
  75static void sco_sock_timeout(unsigned long arg)
  76{
  77        struct sock *sk = (struct sock *) arg;
  78
  79        BT_DBG("sock %p state %d", sk, sk->sk_state);
  80
  81        bh_lock_sock(sk);
  82        sk->sk_err = ETIMEDOUT;
  83        sk->sk_state_change(sk);
  84        bh_unlock_sock(sk);
  85
  86        sco_sock_kill(sk);
  87        sock_put(sk);
  88}
  89
  90static void sco_sock_set_timer(struct sock *sk, long timeout)
  91{
  92        BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
  93        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  94}
  95
  96static void sco_sock_clear_timer(struct sock *sk)
  97{
  98        BT_DBG("sock %p state %d", sk, sk->sk_state);
  99        sk_stop_timer(sk, &sk->sk_timer);
 100}
 101
 102/* ---- SCO connections ---- */
 103static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
 104{
 105        struct hci_dev *hdev = hcon->hdev;
 106        struct sco_conn *conn = hcon->sco_data;
 107
 108        if (conn || status)
 109                return conn;
 110
 111        conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
 112        if (!conn)
 113                return NULL;
 114
 115        spin_lock_init(&conn->lock);
 116
 117        hcon->sco_data = conn;
 118        conn->hcon = hcon;
 119
 120        conn->src = &hdev->bdaddr;
 121        conn->dst = &hcon->dst;
 122
 123        if (hdev->sco_mtu > 0)
 124                conn->mtu = hdev->sco_mtu;
 125        else
 126                conn->mtu = 60;
 127
 128        BT_DBG("hcon %p conn %p", hcon, conn);
 129
 130        return conn;
 131}
 132
 133static inline struct sock *sco_chan_get(struct sco_conn *conn)
 134{
 135        struct sock *sk = NULL;
 136        sco_conn_lock(conn);
 137        sk = conn->sk;
 138        sco_conn_unlock(conn);
 139        return sk;
 140}
 141
 142static int sco_conn_del(struct hci_conn *hcon, int err)
 143{
 144        struct sco_conn *conn;
 145        struct sock *sk;
 146
 147        if (!(conn = hcon->sco_data))
 148                return 0;
 149
 150        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 151
 152        /* Kill socket */
 153        if ((sk = sco_chan_get(conn))) {
 154                bh_lock_sock(sk);
 155                sco_sock_clear_timer(sk);
 156                sco_chan_del(sk, err);
 157                bh_unlock_sock(sk);
 158                sco_sock_kill(sk);
 159        }
 160
 161        hcon->sco_data = NULL;
 162        kfree(conn);
 163        return 0;
 164}
 165
 166static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 167{
 168        int err = 0;
 169
 170        sco_conn_lock(conn);
 171        if (conn->sk) {
 172                err = -EBUSY;
 173        } else {
 174                __sco_chan_add(conn, sk, parent);
 175        }
 176        sco_conn_unlock(conn);
 177        return err;
 178}
 179
 180static int sco_connect(struct sock *sk)
 181{
 182        bdaddr_t *src = &bt_sk(sk)->src;
 183        bdaddr_t *dst = &bt_sk(sk)->dst;
 184        struct sco_conn *conn;
 185        struct hci_conn *hcon;
 186        struct hci_dev  *hdev;
 187        int err, type;
 188
 189        BT_DBG("%s -> %s", batostr(src), batostr(dst));
 190
 191        if (!(hdev = hci_get_route(dst, src)))
 192                return -EHOSTUNREACH;
 193
 194        hci_dev_lock_bh(hdev);
 195
 196        err = -ENOMEM;
 197
 198        if (lmp_esco_capable(hdev) && !disable_esco)
 199                type = ESCO_LINK;
 200        else
 201                type = SCO_LINK;
 202
 203        hcon = hci_connect(hdev, type, dst, HCI_AT_NO_BONDING);
 204        if (!hcon)
 205                goto done;
 206
 207        conn = sco_conn_add(hcon, 0);
 208        if (!conn) {
 209                hci_conn_put(hcon);
 210                goto done;
 211        }
 212
 213        /* Update source addr of the socket */
 214        bacpy(src, conn->src);
 215
 216        err = sco_chan_add(conn, sk, NULL);
 217        if (err)
 218                goto done;
 219
 220        if (hcon->state == BT_CONNECTED) {
 221                sco_sock_clear_timer(sk);
 222                sk->sk_state = BT_CONNECTED;
 223        } else {
 224                sk->sk_state = BT_CONNECT;
 225                sco_sock_set_timer(sk, sk->sk_sndtimeo);
 226        }
 227
 228done:
 229        hci_dev_unlock_bh(hdev);
 230        hci_dev_put(hdev);
 231        return err;
 232}
 233
 234static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 235{
 236        struct sco_conn *conn = sco_pi(sk)->conn;
 237        struct sk_buff *skb;
 238        int err, count;
 239
 240        /* Check outgoing MTU */
 241        if (len > conn->mtu)
 242                return -EINVAL;
 243
 244        BT_DBG("sk %p len %d", sk, len);
 245
 246        count = min_t(unsigned int, conn->mtu, len);
 247        if (!(skb = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
 248                return err;
 249
 250        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
 251                err = -EFAULT;
 252                goto fail;
 253        }
 254
 255        if ((err = hci_send_sco(conn->hcon, skb)) < 0)
 256                return err;
 257
 258        return count;
 259
 260fail:
 261        kfree_skb(skb);
 262        return err;
 263}
 264
 265static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 266{
 267        struct sock *sk = sco_chan_get(conn);
 268
 269        if (!sk)
 270                goto drop;
 271
 272        BT_DBG("sk %p len %d", sk, skb->len);
 273
 274        if (sk->sk_state != BT_CONNECTED)
 275                goto drop;
 276
 277        if (!sock_queue_rcv_skb(sk, skb))
 278                return;
 279
 280drop:
 281        kfree_skb(skb);
 282        return;
 283}
 284
 285/* -------- Socket interface ---------- */
 286static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
 287{
 288        struct sock *sk;
 289        struct hlist_node *node;
 290
 291        sk_for_each(sk, node, &sco_sk_list.head)
 292                if (!bacmp(&bt_sk(sk)->src, ba))
 293                        goto found;
 294        sk = NULL;
 295found:
 296        return sk;
 297}
 298
 299/* Find socket listening on source bdaddr.
 300 * Returns closest match.
 301 */
 302static struct sock *sco_get_sock_listen(bdaddr_t *src)
 303{
 304        struct sock *sk = NULL, *sk1 = NULL;
 305        struct hlist_node *node;
 306
 307        read_lock(&sco_sk_list.lock);
 308
 309        sk_for_each(sk, node, &sco_sk_list.head) {
 310                if (sk->sk_state != BT_LISTEN)
 311                        continue;
 312
 313                /* Exact match. */
 314                if (!bacmp(&bt_sk(sk)->src, src))
 315                        break;
 316
 317                /* Closest match */
 318                if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 319                        sk1 = sk;
 320        }
 321
 322        read_unlock(&sco_sk_list.lock);
 323
 324        return node ? sk : sk1;
 325}
 326
 327static void sco_sock_destruct(struct sock *sk)
 328{
 329        BT_DBG("sk %p", sk);
 330
 331        skb_queue_purge(&sk->sk_receive_queue);
 332        skb_queue_purge(&sk->sk_write_queue);
 333}
 334
 335static void sco_sock_cleanup_listen(struct sock *parent)
 336{
 337        struct sock *sk;
 338
 339        BT_DBG("parent %p", parent);
 340
 341        /* Close not yet accepted channels */
 342        while ((sk = bt_accept_dequeue(parent, NULL))) {
 343                sco_sock_close(sk);
 344                sco_sock_kill(sk);
 345        }
 346
 347        parent->sk_state  = BT_CLOSED;
 348        sock_set_flag(parent, SOCK_ZAPPED);
 349}
 350
 351/* Kill socket (only if zapped and orphan)
 352 * Must be called on unlocked socket.
 353 */
 354static void sco_sock_kill(struct sock *sk)
 355{
 356        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 357                return;
 358
 359        BT_DBG("sk %p state %d", sk, sk->sk_state);
 360
 361        /* Kill poor orphan */
 362        bt_sock_unlink(&sco_sk_list, sk);
 363        sock_set_flag(sk, SOCK_DEAD);
 364        sock_put(sk);
 365}
 366
 367/* Close socket.
 368 * Must be called on unlocked socket.
 369 */
 370static void sco_sock_close(struct sock *sk)
 371{
 372        struct sco_conn *conn;
 373
 374        sco_sock_clear_timer(sk);
 375
 376        lock_sock(sk);
 377
 378        conn = sco_pi(sk)->conn;
 379
 380        BT_DBG("sk %p state %d conn %p socket %p", sk, sk->sk_state, conn, sk->sk_socket);
 381
 382        switch (sk->sk_state) {
 383        case BT_LISTEN:
 384                sco_sock_cleanup_listen(sk);
 385                break;
 386
 387        case BT_CONNECTED:
 388        case BT_CONFIG:
 389        case BT_CONNECT:
 390        case BT_DISCONN:
 391                sco_chan_del(sk, ECONNRESET);
 392                break;
 393
 394        default:
 395                sock_set_flag(sk, SOCK_ZAPPED);
 396                break;
 397        }
 398
 399        release_sock(sk);
 400
 401        sco_sock_kill(sk);
 402}
 403
 404static void sco_sock_init(struct sock *sk, struct sock *parent)
 405{
 406        BT_DBG("sk %p", sk);
 407
 408        if (parent)
 409                sk->sk_type = parent->sk_type;
 410}
 411
 412static struct proto sco_proto = {
 413        .name                = "SCO",
 414        .owner                = THIS_MODULE,
 415        .obj_size        = sizeof(struct sco_pinfo)
 416};
 417
 418static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 419{
 420        struct sock *sk;
 421
 422        sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
 423        if (!sk)
 424                return NULL;
 425
 426        sock_init_data(sock, sk);
 427        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 428
 429        sk->sk_destruct = sco_sock_destruct;
 430        sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 431
 432        sock_reset_flag(sk, SOCK_ZAPPED);
 433
 434        sk->sk_protocol = proto;
 435        sk->sk_state    = BT_OPEN;
 436
 437        setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 438
 439        bt_sock_link(&sco_sk_list, sk);
 440        return sk;
 441}
 442
 443static int sco_sock_create(struct net *net, struct socket *sock, int protocol)
 444{
 445        struct sock *sk;
 446
 447        BT_DBG("sock %p", sock);
 448
 449        sock->state = SS_UNCONNECTED;
 450
 451        if (sock->type != SOCK_SEQPACKET)
 452                return -ESOCKTNOSUPPORT;
 453
 454        sock->ops = &sco_sock_ops;
 455
 456        sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 457        if (!sk)
 458                return -ENOMEM;
 459
 460        sco_sock_init(sk, NULL);
 461        return 0;
 462}
 463
 464static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 465{
 466        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 467        struct sock *sk = sock->sk;
 468        bdaddr_t *src = &sa->sco_bdaddr;
 469        int err = 0;
 470
 471        BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
 472
 473        if (!addr || addr->sa_family != AF_BLUETOOTH)
 474                return -EINVAL;
 475
 476        lock_sock(sk);
 477
 478        if (sk->sk_state != BT_OPEN) {
 479                err = -EBADFD;
 480                goto done;
 481        }
 482
 483        write_lock_bh(&sco_sk_list.lock);
 484
 485        if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
 486                err = -EADDRINUSE;
 487        } else {
 488                /* Save source address */
 489                bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
 490                sk->sk_state = BT_BOUND;
 491        }
 492
 493        write_unlock_bh(&sco_sk_list.lock);
 494
 495done:
 496        release_sock(sk);
 497        return err;
 498}
 499
 500static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 501{
 502        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 503        struct sock *sk = sock->sk;
 504        int err = 0;
 505
 506
 507        BT_DBG("sk %p", sk);
 508
 509        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
 510                return -EINVAL;
 511
 512        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 513                return -EBADFD;
 514
 515        if (sk->sk_type != SOCK_SEQPACKET)
 516                return -EINVAL;
 517
 518        lock_sock(sk);
 519
 520        /* Set destination address and psm */
 521        bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 522
 523        if ((err = sco_connect(sk)))
 524                goto done;
 525
 526        err = bt_sock_wait_state(sk, BT_CONNECTED,
 527                        sock_sndtimeo(sk, flags & O_NONBLOCK));
 528
 529done:
 530        release_sock(sk);
 531        return err;
 532}
 533
 534static int sco_sock_listen(struct socket *sock, int backlog)
 535{
 536        struct sock *sk = sock->sk;
 537        int err = 0;
 538
 539        BT_DBG("sk %p backlog %d", sk, backlog);
 540
 541        lock_sock(sk);
 542
 543        if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
 544                err = -EBADFD;
 545                goto done;
 546        }
 547
 548        sk->sk_max_ack_backlog = backlog;
 549        sk->sk_ack_backlog = 0;
 550        sk->sk_state = BT_LISTEN;
 551
 552done:
 553        release_sock(sk);
 554        return err;
 555}
 556
 557static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 558{
 559        DECLARE_WAITQUEUE(wait, current);
 560        struct sock *sk = sock->sk, *ch;
 561        long timeo;
 562        int err = 0;
 563
 564        lock_sock(sk);
 565
 566        if (sk->sk_state != BT_LISTEN) {
 567                err = -EBADFD;
 568                goto done;
 569        }
 570
 571        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 572
 573        BT_DBG("sk %p timeo %ld", sk, timeo);
 574
 575        /* Wait for an incoming connection. (wake-one). */
 576        add_wait_queue_exclusive(sk->sk_sleep, &wait);
 577        while (!(ch = bt_accept_dequeue(sk, newsock))) {
 578                set_current_state(TASK_INTERRUPTIBLE);
 579                if (!timeo) {
 580                        err = -EAGAIN;
 581                        break;
 582                }
 583
 584                release_sock(sk);
 585                timeo = schedule_timeout(timeo);
 586                lock_sock(sk);
 587
 588                if (sk->sk_state != BT_LISTEN) {
 589                        err = -EBADFD;
 590                        break;
 591                }
 592
 593                if (signal_pending(current)) {
 594                        err = sock_intr_errno(timeo);
 595                        break;
 596                }
 597        }
 598        set_current_state(TASK_RUNNING);
 599        remove_wait_queue(sk->sk_sleep, &wait);
 600
 601        if (err)
 602                goto done;
 603
 604        newsock->state = SS_CONNECTED;
 605
 606        BT_DBG("new socket %p", ch);
 607
 608done:
 609        release_sock(sk);
 610        return err;
 611}
 612
 613static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 614{
 615        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 616        struct sock *sk = sock->sk;
 617
 618        BT_DBG("sock %p, sk %p", sock, sk);
 619
 620        addr->sa_family = AF_BLUETOOTH;
 621        *len = sizeof(struct sockaddr_sco);
 622
 623        if (peer)
 624                bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
 625        else
 626                bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
 627
 628        return 0;
 629}
 630
 631static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 632                            struct msghdr *msg, size_t len)
 633{
 634        struct sock *sk = sock->sk;
 635        int err = 0;
 636
 637        BT_DBG("sock %p, sk %p", sock, sk);
 638
 639        err = sock_error(sk);
 640        if (err)
 641                return err;
 642
 643        if (msg->msg_flags & MSG_OOB)
 644                return -EOPNOTSUPP;
 645
 646        lock_sock(sk);
 647
 648        if (sk->sk_state == BT_CONNECTED)
 649                err = sco_send_frame(sk, msg, len);
 650        else
 651                err = -ENOTCONN;
 652
 653        release_sock(sk);
 654        return err;
 655}
 656
 657static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 658{
 659        struct sock *sk = sock->sk;
 660        int err = 0;
 661
 662        BT_DBG("sk %p", sk);
 663
 664        lock_sock(sk);
 665
 666        switch (optname) {
 667        default:
 668                err = -ENOPROTOOPT;
 669                break;
 670        }
 671
 672        release_sock(sk);
 673        return err;
 674}
 675
 676static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 677{
 678        struct sock *sk = sock->sk;
 679        struct sco_options opts;
 680        struct sco_conninfo cinfo;
 681        int len, err = 0;
 682
 683        BT_DBG("sk %p", sk);
 684
 685        if (get_user(len, optlen))
 686                return -EFAULT;
 687
 688        lock_sock(sk);
 689
 690        switch (optname) {
 691        case SCO_OPTIONS:
 692                if (sk->sk_state != BT_CONNECTED) {
 693                        err = -ENOTCONN;
 694                        break;
 695                }
 696
 697                opts.mtu = sco_pi(sk)->conn->mtu;
 698
 699                BT_DBG("mtu %d", opts.mtu);
 700
 701                len = min_t(unsigned int, len, sizeof(opts));
 702                if (copy_to_user(optval, (char *)&opts, len))
 703                        err = -EFAULT;
 704
 705                break;
 706
 707        case SCO_CONNINFO:
 708                if (sk->sk_state != BT_CONNECTED) {
 709                        err = -ENOTCONN;
 710                        break;
 711                }
 712
 713                cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 714                memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 715
 716                len = min_t(unsigned int, len, sizeof(cinfo));
 717                if (copy_to_user(optval, (char *)&cinfo, len))
 718                        err = -EFAULT;
 719
 720                break;
 721
 722        default:
 723                err = -ENOPROTOOPT;
 724                break;
 725        }
 726
 727        release_sock(sk);
 728        return err;
 729}
 730
 731static int sco_sock_release(struct socket *sock)
 732{
 733        struct sock *sk = sock->sk;
 734        int err = 0;
 735
 736        BT_DBG("sock %p, sk %p", sock, sk);
 737
 738        if (!sk)
 739                return 0;
 740
 741        sco_sock_close(sk);
 742
 743        if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
 744                lock_sock(sk);
 745                err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 746                release_sock(sk);
 747        }
 748
 749        sock_orphan(sk);
 750        sco_sock_kill(sk);
 751        return err;
 752}
 753
 754static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 755{
 756        BT_DBG("conn %p", conn);
 757
 758        sco_pi(sk)->conn = conn;
 759        conn->sk = sk;
 760
 761        if (parent)
 762                bt_accept_enqueue(parent, sk);
 763}
 764
 765/* Delete channel.
 766 * Must be called on the locked socket. */
 767static void sco_chan_del(struct sock *sk, int err)
 768{
 769        struct sco_conn *conn;
 770
 771        conn = sco_pi(sk)->conn;
 772
 773        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 774
 775        if (conn) {
 776                sco_conn_lock(conn);
 777                conn->sk = NULL;
 778                sco_pi(sk)->conn = NULL;
 779                sco_conn_unlock(conn);
 780                hci_conn_put(conn->hcon);
 781        }
 782
 783        sk->sk_state = BT_CLOSED;
 784        sk->sk_err   = err;
 785        sk->sk_state_change(sk);
 786
 787        sock_set_flag(sk, SOCK_ZAPPED);
 788}
 789
 790static void sco_conn_ready(struct sco_conn *conn)
 791{
 792        struct sock *parent, *sk;
 793
 794        BT_DBG("conn %p", conn);
 795
 796        sco_conn_lock(conn);
 797
 798        if ((sk = conn->sk)) {
 799                sco_sock_clear_timer(sk);
 800                bh_lock_sock(sk);
 801                sk->sk_state = BT_CONNECTED;
 802                sk->sk_state_change(sk);
 803                bh_unlock_sock(sk);
 804        } else {
 805                parent = sco_get_sock_listen(conn->src);
 806                if (!parent)
 807                        goto done;
 808
 809                bh_lock_sock(parent);
 810
 811                sk = sco_sock_alloc(sock_net(parent), NULL, BTPROTO_SCO, GFP_ATOMIC);
 812                if (!sk) {
 813                        bh_unlock_sock(parent);
 814                        goto done;
 815                }
 816
 817                sco_sock_init(sk, parent);
 818
 819                bacpy(&bt_sk(sk)->src, conn->src);
 820                bacpy(&bt_sk(sk)->dst, conn->dst);
 821
 822                hci_conn_hold(conn->hcon);
 823                __sco_chan_add(conn, sk, parent);
 824
 825                sk->sk_state = BT_CONNECTED;
 826
 827                /* Wake up parent */
 828                parent->sk_data_ready(parent, 1);
 829
 830                bh_unlock_sock(parent);
 831        }
 832
 833done:
 834        sco_conn_unlock(conn);
 835}
 836
 837/* ----- SCO interface with lower layer (HCI) ----- */
 838static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
 839{
 840        BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
 841
 842        /* Always accept connection */
 843        return HCI_LM_ACCEPT;
 844}
 845
 846static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 847{
 848        BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
 849
 850        if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
 851                return 0;
 852
 853        if (!status) {
 854                struct sco_conn *conn;
 855
 856                conn = sco_conn_add(hcon, status);
 857                if (conn)
 858                        sco_conn_ready(conn);
 859        } else
 860                sco_conn_del(hcon, bt_err(status));
 861
 862        return 0;
 863}
 864
 865static int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
 866{
 867        BT_DBG("hcon %p reason %d", hcon, reason);
 868
 869        if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
 870                return 0;
 871
 872        sco_conn_del(hcon, bt_err(reason));
 873
 874        return 0;
 875}
 876
 877static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
 878{
 879        struct sco_conn *conn = hcon->sco_data;
 880
 881        if (!conn)
 882                goto drop;
 883
 884        BT_DBG("conn %p len %d", conn, skb->len);
 885
 886        if (skb->len) {
 887                sco_recv_frame(conn, skb);
 888                return 0;
 889        }
 890
 891drop:
 892        kfree_skb(skb);
 893        return 0;
 894}
 895
 896static ssize_t sco_sysfs_show(struct class *dev, char *buf)
 897{
 898        struct sock *sk;
 899        struct hlist_node *node;
 900        char *str = buf;
 901
 902        read_lock_bh(&sco_sk_list.lock);
 903
 904        sk_for_each(sk, node, &sco_sk_list.head) {
 905                str += sprintf(str, "%s %s %d\n",
 906                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
 907                                sk->sk_state);
 908        }
 909
 910        read_unlock_bh(&sco_sk_list.lock);
 911
 912        return (str - buf);
 913}
 914
 915static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
 916
 917static const struct proto_ops sco_sock_ops = {
 918        .family                = PF_BLUETOOTH,
 919        .owner                = THIS_MODULE,
 920        .release        = sco_sock_release,
 921        .bind                = sco_sock_bind,
 922        .connect        = sco_sock_connect,
 923        .listen                = sco_sock_listen,
 924        .accept                = sco_sock_accept,
 925        .getname        = sco_sock_getname,
 926        .sendmsg        = sco_sock_sendmsg,
 927        .recvmsg        = bt_sock_recvmsg,
 928        .poll                = bt_sock_poll,
 929        .ioctl                = bt_sock_ioctl,
 930        .mmap                = sock_no_mmap,
 931        .socketpair        = sock_no_socketpair,
 932        .shutdown        = sock_no_shutdown,
 933        .setsockopt        = sco_sock_setsockopt,
 934        .getsockopt        = sco_sock_getsockopt
 935};
 936
 937static struct net_proto_family sco_sock_family_ops = {
 938        .family        = PF_BLUETOOTH,
 939        .owner        = THIS_MODULE,
 940        .create        = sco_sock_create,
 941};
 942
 943static struct hci_proto sco_hci_proto = {
 944        .name                = "SCO",
 945        .id                = HCI_PROTO_SCO,
 946        .connect_ind        = sco_connect_ind,
 947        .connect_cfm        = sco_connect_cfm,
 948        .disconn_ind        = sco_disconn_ind,
 949        .recv_scodata        = sco_recv_scodata
 950};
 951
 952static int __init sco_init(void)
 953{
 954        int err;
 955
 956        err = proto_register(&sco_proto, 0);
 957        if (err < 0)
 958                return err;
 959
 960        err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
 961        if (err < 0) {
 962                BT_ERR("SCO socket registration failed");
 963                goto error;
 964        }
 965
 966        err = hci_register_proto(&sco_hci_proto);
 967        if (err < 0) {
 968                BT_ERR("SCO protocol registration failed");
 969                bt_sock_unregister(BTPROTO_SCO);
 970                goto error;
 971        }
 972
 973        if (class_create_file(bt_class, &class_attr_sco) < 0)
 974                BT_ERR("Failed to create SCO info file");
 975
 976        BT_INFO("SCO (Voice Link) ver %s", VERSION);
 977        BT_INFO("SCO socket layer initialized");
 978
 979        return 0;
 980
 981error:
 982        proto_unregister(&sco_proto);
 983        return err;
 984}
 985
 986static void __exit sco_exit(void)
 987{
 988        class_remove_file(bt_class, &class_attr_sco);
 989
 990        if (bt_sock_unregister(BTPROTO_SCO) < 0)
 991                BT_ERR("SCO socket unregistration failed");
 992
 993        if (hci_unregister_proto(&sco_hci_proto) < 0)
 994                BT_ERR("SCO protocol unregistration failed");
 995
 996        proto_unregister(&sco_proto);
 997}
 998
 999module_init(sco_init);
1000module_exit(sco_exit);
1001
1002module_param(disable_esco, bool, 0644);
1003MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1004
1005MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1006MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1007MODULE_VERSION(VERSION);
1008MODULE_LICENSE("GPL");
1009MODULE_ALIAS("bt-proto-2");