1
0
Files
kernel-49/net/nfc/llcp_sock.c
Greg Kroah-Hartman fee50d6688 Merge 4.9.298 into android-4.9-q
Changes in 4.9.298
	Bluetooth: bfusb: fix division by zero in send path
	USB: core: Fix bug in resuming hub's handling of wakeup requests
	USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
	mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
	can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
	can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
	random: fix data race on crng_node_pool
	random: fix data race on crng init time
	staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
	drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
	media: uvcvideo: fix division by zero at stream start
	rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled
	HID: uhid: Fix worker destroying device without any protection
	HID: wacom: Avoid using stale array indicies to read contact count
	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
	rtc: cmos: take rtc_lock while reading from CMOS
	media: flexcop-usb: fix control-message timeouts
	media: mceusb: fix control-message timeouts
	media: em28xx: fix control-message timeouts
	media: cpia2: fix control-message timeouts
	media: s2255: fix control-message timeouts
	media: dib0700: fix undefined behavior in tuner shutdown
	media: redrat3: fix control-message timeouts
	media: pvrusb2: fix control-message timeouts
	media: stk1160: fix control-message timeouts
	can: softing_cs: softingcs_probe(): fix memleak on registration failure
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
	shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
	Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
	wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
	Bluetooth: stop proccessing malicious adv data
	media: dmxdev: fix UAF when dvb_register_device() fails
	crypto: qce - fix uaf on qce_ahash_register_one
	tty: serial: atmel: Check return code of dmaengine_submit()
	tty: serial: atmel: Call dma_async_issue_pending()
	netfilter: bridge: add support for pppoe filtering
	arm64: dts: qcom: msm8916: fix MMC controller aliases
	drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
	drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
	serial: amba-pl011: do not request memory region twice
	floppy: Fix hang in watchdog when disk is ejected
	media: dib8000: Fix a memleak in dib8000_init()
	media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
	media: si2157: Fix "warm" tuner state detection
	media: msi001: fix possible null-ptr-deref in msi001_probe()
	usb: ftdi-elan: fix memory leak on device disconnect
	pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
	pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
	ppp: ensure minimum packet size in ppp_write()
	fsl/fman: Check for null pointer after calling devm_ioremap
	spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
	can: softing: softing_startstop(): fix set but not used variable warning
	can: xilinx_can: xcan_probe(): check for error irq
	pcmcia: fix setting of kthread task states
	net: mcs7830: handle usb read errors properly
	ext4: avoid trim error on fs with small groups
	ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
	ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
	ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
	RDMA/hns: Validate the pkey index
	powerpc/prom_init: Fix improper check of prom_getprop()
	ALSA: oss: fix compile error when OSS_DEBUG is enabled
	char/mwave: Adjust io port register size
	scsi: ufs: Fix race conditions related to driver data
	RDMA/core: Let ib_find_gid() continue search even after empty entry
	dmaengine: pxa/mmp: stop referencing config->slave_id
	ASoC: samsung: idma: Check of ioremap return value
	misc: lattice-ecp3-config: Fix task hung when firmware load failed
	mips: lantiq: add support for clk_set_parent()
	mips: bcm63xx: add support for clk_set_parent()
	RDMA/cxgb4: Set queue pair state when being queried
	Bluetooth: Fix debugfs entry leak in hci_register_dev()
	fs: dlm: filter user dlm messages for kernel locks
	ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
	usb: gadget: f_fs: Use stream_open() for endpoint files
	HID: apple: Do not reset quirks when the Fn key is not found
	media: b2c2: Add missing check in flexcop_pci_isr:
	gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
	HSI: core: Fix return freed object in hsi_new_client
	mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
	floppy: Add max size check for user space request
	media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
	media: m920x: don't use stack on USB reads
	iwlwifi: mvm: synchronize with FW after multicast commands
	ath10k: Fix tx hanging
	net: bonding: debug: avoid printing debug logs when bond is not notifying peers
	media: igorplugusb: receiver overflow should be reported
	media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
	usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
	ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
	um: registers: Rename function names to avoid conflicts and build problems
	jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
	ACPICA: Utilities: Avoid deleting the same object twice in a row
	ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
	btrfs: remove BUG_ON() in find_parent_nodes()
	btrfs: remove BUG_ON(!eie) in find_parent_nodes
	net: mdio: Demote probed message to debug print
	dm btree: add a defensive bounds check to insert_at()
	dm space map common: add bounds check to sm_ll_lookup_bitmap()
	serial: pl010: Drop CR register reset on set_termios
	serial: core: Keep mctrl register state and cached copy in sync
	parisc: Avoid calling faulthandler_disabled() twice
	powerpc/6xx: add missing of_node_put
	powerpc/powernv: add missing of_node_put
	powerpc/cell: add missing of_node_put
	powerpc/btext: add missing of_node_put
	i2c: i801: Don't silently correct invalid transfer size
	powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
	i2c: mpc: Correct I2C reset procedure
	w1: Misuse of get_user()/put_user() reported by sparse
	ALSA: seq: Set upper limit of processed events
	i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
	MIPS: Octeon: Fix build errors using clang
	scsi: sr: Don't use GFP_DMA
	ASoC: mediatek: mt8173: fix device_node leak
	power: bq25890: Enable continuous conversion for ADC at charging
	ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
	iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
	ext4: set csum seed in tmp inode while migrating to extents
	ext4: Fix BUG_ON in ext4_bread when write quota data
	ext4: don't use the orphan list when migrating an inode
	fuse: fix bad inode
	fuse: fix live lock in fuse_iget()
	drm/radeon: fix error handling in radeon_driver_open_kms
	RDMA/hns: Modify the mapping attribute of doorbell to device
	RDMA/rxe: Fix a typo in opcode name
	powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
	net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
	parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
	net: axienet: Wait for PhyRstCmplt after core reset
	net: axienet: fix number of TX ring slots for available check
	netns: add schedule point in ops_exit_list()
	libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
	dmaengine: at_xdmac: Don't start transactions at tx_submit level
	dmaengine: at_xdmac: Print debug message after realeasing the lock
	dmaengine: at_xdmac: Fix lld view setting
	dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
	net_sched: restore "mpu xxx" handling
	bcmgenet: add WOL IRQ check
	scripts/dtc: dtx_diff: remove broken example from help text
	lib82596: Fix IRQ check in sni_82596_probe
	Revert "gup: document and work around "COW can break either way" issue"
	gup: document and work around "COW can break either way" issue
	drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
	gianfar: simplify FCS handling and fix memory leak
	gianfar: fix jumbo packets+napi+rx overrun crash
	cipso,calipso: resolve a number of problems with the DOI refcounts
	rbtree: cache leftmost node internally
	lib/timerqueue: Rely on rbtree semantics for next timer
	mm: add follow_pte_pmd()
	KVM: do not assume PTE is writable after follow_pfn
	KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
	KVM: do not allow mapping valid but non-reference-counted pages
	Linux 4.9.298

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifcea82a702a0906d9090c89785363c2d5423f652
2022-01-31 17:10:19 +03:00

1071 lines
23 KiB
C

/*
* Copyright (C) 2011 Intel Corporation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#define pr_fmt(fmt) "llcp: %s: " fmt, __func__
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/nfc.h>
#include "nfc.h"
#include "llcp.h"
static int sock_wait_state(struct sock *sk, int state, unsigned long timeo)
{
DECLARE_WAITQUEUE(wait, current);
int err = 0;
pr_debug("sk %p", sk);
add_wait_queue(sk_sleep(sk), &wait);
set_current_state(TASK_INTERRUPTIBLE);
while (sk->sk_state != state) {
if (!timeo) {
err = -EINPROGRESS;
break;
}
if (signal_pending(current)) {
err = sock_intr_errno(timeo);
break;
}
release_sock(sk);
timeo = schedule_timeout(timeo);
lock_sock(sk);
set_current_state(TASK_INTERRUPTIBLE);
err = sock_error(sk);
if (err)
break;
}
__set_current_state(TASK_RUNNING);
remove_wait_queue(sk_sleep(sk), &wait);
return err;
}
static struct proto llcp_sock_proto = {
.name = "NFC_LLCP",
.owner = THIS_MODULE,
.obj_size = sizeof(struct nfc_llcp_sock),
};
static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
struct nfc_llcp_local *local;
struct nfc_dev *dev;
struct sockaddr_nfc_llcp llcp_addr;
int len, ret = 0;
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
addr->sa_family != AF_NFC)
return -EINVAL;
pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
memset(&llcp_addr, 0, sizeof(llcp_addr));
len = min_t(unsigned int, sizeof(llcp_addr), alen);
memcpy(&llcp_addr, addr, len);
/* This is going to be a listening socket, dsap must be 0 */
if (llcp_addr.dsap != 0)
return -EINVAL;
lock_sock(sk);
if (sk->sk_state != LLCP_CLOSED) {
ret = -EBADFD;
goto error;
}
dev = nfc_get_device(llcp_addr.dev_idx);
if (dev == NULL) {
ret = -ENODEV;
goto error;
}
local = nfc_llcp_find_local(dev);
if (local == NULL) {
ret = -ENODEV;
goto put_dev;
}
llcp_sock->dev = dev;
llcp_sock->local = nfc_llcp_local_get(local);
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
llcp_sock->service_name_len = min_t(unsigned int,
llcp_addr.service_name_len,
NFC_LLCP_MAX_SERVICE_NAME);
llcp_sock->service_name = kmemdup(llcp_addr.service_name,
llcp_sock->service_name_len,
GFP_KERNEL);
if (!llcp_sock->service_name) {
nfc_llcp_local_put(llcp_sock->local);
llcp_sock->local = NULL;
llcp_sock->dev = NULL;
ret = -ENOMEM;
goto put_dev;
}
llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
if (llcp_sock->ssap == LLCP_SAP_MAX) {
nfc_llcp_local_put(llcp_sock->local);
llcp_sock->local = NULL;
kfree(llcp_sock->service_name);
llcp_sock->service_name = NULL;
llcp_sock->dev = NULL;
ret = -EADDRINUSE;
goto put_dev;
}
llcp_sock->reserved_ssap = llcp_sock->ssap;
nfc_llcp_sock_link(&local->sockets, sk);
pr_debug("Socket bound to SAP %d\n", llcp_sock->ssap);
sk->sk_state = LLCP_BOUND;
put_dev:
nfc_put_device(dev);
error:
release_sock(sk);
return ret;
}
static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
int alen)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
struct nfc_llcp_local *local;
struct nfc_dev *dev;
struct sockaddr_nfc_llcp llcp_addr;
int len, ret = 0;
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
addr->sa_family != AF_NFC)
return -EINVAL;
pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
memset(&llcp_addr, 0, sizeof(llcp_addr));
len = min_t(unsigned int, sizeof(llcp_addr), alen);
memcpy(&llcp_addr, addr, len);
lock_sock(sk);
if (sk->sk_state != LLCP_CLOSED) {
ret = -EBADFD;
goto error;
}
dev = nfc_get_device(llcp_addr.dev_idx);
if (dev == NULL) {
ret = -ENODEV;
goto error;
}
local = nfc_llcp_find_local(dev);
if (local == NULL) {
ret = -ENODEV;
goto put_dev;
}
llcp_sock->dev = dev;
llcp_sock->local = nfc_llcp_local_get(local);
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
nfc_llcp_sock_link(&local->raw_sockets, sk);
sk->sk_state = LLCP_BOUND;
put_dev:
nfc_put_device(dev);
error:
release_sock(sk);
return ret;
}
static int llcp_sock_listen(struct socket *sock, int backlog)
{
struct sock *sk = sock->sk;
int ret = 0;
pr_debug("sk %p backlog %d\n", sk, backlog);
lock_sock(sk);
if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM) ||
sk->sk_state != LLCP_BOUND) {
ret = -EBADFD;
goto error;
}
sk->sk_max_ack_backlog = backlog;
sk->sk_ack_backlog = 0;
pr_debug("Socket listening\n");
sk->sk_state = LLCP_LISTEN;
error:
release_sock(sk);
return ret;
}
static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
char __user *optval, unsigned int optlen)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
u32 opt;
int err = 0;
pr_debug("%p optname %d\n", sk, optname);
if (level != SOL_NFC)
return -ENOPROTOOPT;
lock_sock(sk);
switch (optname) {
case NFC_LLCP_RW:
if (sk->sk_state == LLCP_CONNECTED ||
sk->sk_state == LLCP_BOUND ||
sk->sk_state == LLCP_LISTEN) {
err = -EINVAL;
break;
}
if (get_user(opt, (u32 __user *) optval)) {
err = -EFAULT;
break;
}
if (opt > LLCP_MAX_RW) {
err = -EINVAL;
break;
}
llcp_sock->rw = (u8) opt;
break;
case NFC_LLCP_MIUX:
if (sk->sk_state == LLCP_CONNECTED ||
sk->sk_state == LLCP_BOUND ||
sk->sk_state == LLCP_LISTEN) {
err = -EINVAL;
break;
}
if (get_user(opt, (u32 __user *) optval)) {
err = -EFAULT;
break;
}
if (opt > LLCP_MAX_MIUX) {
err = -EINVAL;
break;
}
llcp_sock->miux = cpu_to_be16((u16) opt);
break;
default:
err = -ENOPROTOOPT;
break;
}
release_sock(sk);
pr_debug("%p rw %d miux %d\n", llcp_sock,
llcp_sock->rw, llcp_sock->miux);
return err;
}
static int nfc_llcp_getsockopt(struct socket *sock, int level, int optname,
char __user *optval, int __user *optlen)
{
struct nfc_llcp_local *local;
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
int len, err = 0;
u16 miux, remote_miu;
u8 rw;
pr_debug("%p optname %d\n", sk, optname);
if (level != SOL_NFC)
return -ENOPROTOOPT;
if (get_user(len, optlen))
return -EFAULT;
local = llcp_sock->local;
if (!local)
return -ENODEV;
len = min_t(u32, len, sizeof(u32));
lock_sock(sk);
switch (optname) {
case NFC_LLCP_RW:
rw = llcp_sock->rw > LLCP_MAX_RW ? local->rw : llcp_sock->rw;
if (put_user(rw, (u32 __user *) optval))
err = -EFAULT;
break;
case NFC_LLCP_MIUX:
miux = be16_to_cpu(llcp_sock->miux) > LLCP_MAX_MIUX ?
be16_to_cpu(local->miux) : be16_to_cpu(llcp_sock->miux);
if (put_user(miux, (u32 __user *) optval))
err = -EFAULT;
break;
case NFC_LLCP_REMOTE_MIU:
remote_miu = llcp_sock->remote_miu > LLCP_MAX_MIU ?
local->remote_miu : llcp_sock->remote_miu;
if (put_user(remote_miu, (u32 __user *) optval))
err = -EFAULT;
break;
case NFC_LLCP_REMOTE_LTO:
if (put_user(local->remote_lto / 10, (u32 __user *) optval))
err = -EFAULT;
break;
case NFC_LLCP_REMOTE_RW:
if (put_user(llcp_sock->remote_rw, (u32 __user *) optval))
err = -EFAULT;
break;
default:
err = -ENOPROTOOPT;
break;
}
release_sock(sk);
if (put_user(len, optlen))
return -EFAULT;
return err;
}
void nfc_llcp_accept_unlink(struct sock *sk)
{
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
pr_debug("state %d\n", sk->sk_state);
list_del_init(&llcp_sock->accept_queue);
sk_acceptq_removed(llcp_sock->parent);
llcp_sock->parent = NULL;
sock_put(sk);
}
void nfc_llcp_accept_enqueue(struct sock *parent, struct sock *sk)
{
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
struct nfc_llcp_sock *llcp_sock_parent = nfc_llcp_sock(parent);
/* Lock will be free from unlink */
sock_hold(sk);
list_add_tail(&llcp_sock->accept_queue,
&llcp_sock_parent->accept_queue);
llcp_sock->parent = parent;
sk_acceptq_added(parent);
}
struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
struct socket *newsock)
{
struct nfc_llcp_sock *lsk, *n, *llcp_parent;
struct sock *sk;
llcp_parent = nfc_llcp_sock(parent);
list_for_each_entry_safe(lsk, n, &llcp_parent->accept_queue,
accept_queue) {
sk = &lsk->sk;
lock_sock(sk);
if (sk->sk_state == LLCP_CLOSED) {
release_sock(sk);
nfc_llcp_accept_unlink(sk);
continue;
}
if (sk->sk_state == LLCP_CONNECTED || !newsock) {
list_del_init(&lsk->accept_queue);
sock_put(sk);
if (newsock)
sock_graft(sk, newsock);
release_sock(sk);
pr_debug("Returning sk state %d\n", sk->sk_state);
sk_acceptq_removed(parent);
return sk;
}
release_sock(sk);
}
return NULL;
}
static int llcp_sock_accept(struct socket *sock, struct socket *newsock,
int flags)
{
DECLARE_WAITQUEUE(wait, current);
struct sock *sk = sock->sk, *new_sk;
long timeo;
int ret = 0;
pr_debug("parent %p\n", sk);
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
if (sk->sk_state != LLCP_LISTEN) {
ret = -EBADFD;
goto error;
}
timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
/* Wait for an incoming connection. */
add_wait_queue_exclusive(sk_sleep(sk), &wait);
while (!(new_sk = nfc_llcp_accept_dequeue(sk, newsock))) {
set_current_state(TASK_INTERRUPTIBLE);
if (!timeo) {
ret = -EAGAIN;
break;
}
if (signal_pending(current)) {
ret = sock_intr_errno(timeo);
break;
}
release_sock(sk);
timeo = schedule_timeout(timeo);
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
}
__set_current_state(TASK_RUNNING);
remove_wait_queue(sk_sleep(sk), &wait);
if (ret)
goto error;
newsock->state = SS_CONNECTED;
pr_debug("new socket %p\n", new_sk);
error:
release_sock(sk);
return ret;
}
static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
int *len, int peer)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, llcp_addr, uaddr);
if (llcp_sock == NULL || llcp_sock->dev == NULL)
return -EBADFD;
pr_debug("%p %d %d %d\n", sk, llcp_sock->target_idx,
llcp_sock->dsap, llcp_sock->ssap);
memset(llcp_addr, 0, sizeof(*llcp_addr));
*len = sizeof(struct sockaddr_nfc_llcp);
lock_sock(sk);
if (!llcp_sock->dev) {
release_sock(sk);
return -EBADFD;
}
llcp_addr->sa_family = AF_NFC;
llcp_addr->dev_idx = llcp_sock->dev->idx;
llcp_addr->target_idx = llcp_sock->target_idx;
llcp_addr->nfc_protocol = llcp_sock->nfc_protocol;
llcp_addr->dsap = llcp_sock->dsap;
llcp_addr->ssap = llcp_sock->ssap;
llcp_addr->service_name_len = llcp_sock->service_name_len;
memcpy(llcp_addr->service_name, llcp_sock->service_name,
llcp_addr->service_name_len);
release_sock(sk);
return 0;
}
static inline unsigned int llcp_accept_poll(struct sock *parent)
{
struct nfc_llcp_sock *llcp_sock, *parent_sock;
struct sock *sk;
parent_sock = nfc_llcp_sock(parent);
list_for_each_entry(llcp_sock, &parent_sock->accept_queue,
accept_queue) {
sk = &llcp_sock->sk;
if (sk->sk_state == LLCP_CONNECTED)
return POLLIN | POLLRDNORM;
}
return 0;
}
static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
poll_table *wait)
{
struct sock *sk = sock->sk;
unsigned int mask = 0;
pr_debug("%p\n", sk);
sock_poll_wait(file, sk_sleep(sk), wait);
if (sk->sk_state == LLCP_LISTEN)
return llcp_accept_poll(sk);
if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
mask |= POLLERR |
(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
if (!skb_queue_empty(&sk->sk_receive_queue))
mask |= POLLIN | POLLRDNORM;
if (sk->sk_state == LLCP_CLOSED)
mask |= POLLHUP;
if (sk->sk_shutdown & RCV_SHUTDOWN)
mask |= POLLRDHUP | POLLIN | POLLRDNORM;
if (sk->sk_shutdown == SHUTDOWN_MASK)
mask |= POLLHUP;
if (sock_writeable(sk) && sk->sk_state == LLCP_CONNECTED)
mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
else
sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
pr_debug("mask 0x%x\n", mask);
return mask;
}
static int llcp_sock_release(struct socket *sock)
{
struct sock *sk = sock->sk;
struct nfc_llcp_local *local;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
int err = 0;
if (!sk)
return 0;
pr_debug("%p\n", sk);
local = llcp_sock->local;
if (local == NULL) {
err = -ENODEV;
goto out;
}
lock_sock(sk);
/* Send a DISC */
if (sk->sk_state == LLCP_CONNECTED)
nfc_llcp_send_disconnect(llcp_sock);
if (sk->sk_state == LLCP_LISTEN) {
struct nfc_llcp_sock *lsk, *n;
struct sock *accept_sk;
list_for_each_entry_safe(lsk, n, &llcp_sock->accept_queue,
accept_queue) {
accept_sk = &lsk->sk;
lock_sock(accept_sk);
nfc_llcp_send_disconnect(lsk);
nfc_llcp_accept_unlink(accept_sk);
release_sock(accept_sk);
}
}
if (llcp_sock->reserved_ssap < LLCP_SAP_MAX)
nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
release_sock(sk);
/* Keep this sock alive and therefore do not remove it from the sockets
* list until the DISC PDU has been actually sent. Otherwise we would
* reply with DM PDUs before sending the DISC one.
*/
if (sk->sk_state == LLCP_DISCONNECTING)
return err;
if (sock->type == SOCK_RAW)
nfc_llcp_sock_unlink(&local->raw_sockets, sk);
else
nfc_llcp_sock_unlink(&local->sockets, sk);
out:
sock_orphan(sk);
sock_put(sk);
return err;
}
static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
int len, int flags)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
struct sockaddr_nfc_llcp *addr = (struct sockaddr_nfc_llcp *)_addr;
struct nfc_dev *dev;
struct nfc_llcp_local *local;
int ret = 0;
pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC)
return -EINVAL;
if (addr->service_name_len == 0 && addr->dsap == 0)
return -EINVAL;
pr_debug("addr dev_idx=%u target_idx=%u protocol=%u\n", addr->dev_idx,
addr->target_idx, addr->nfc_protocol);
lock_sock(sk);
if (sk->sk_state == LLCP_CONNECTED) {
ret = -EISCONN;
goto error;
}
if (sk->sk_state == LLCP_CONNECTING) {
ret = -EINPROGRESS;
goto error;
}
dev = nfc_get_device(addr->dev_idx);
if (dev == NULL) {
ret = -ENODEV;
goto error;
}
local = nfc_llcp_find_local(dev);
if (local == NULL) {
ret = -ENODEV;
goto put_dev;
}
device_lock(&dev->dev);
if (dev->dep_link_up == false) {
ret = -ENOLINK;
device_unlock(&dev->dev);
goto put_dev;
}
device_unlock(&dev->dev);
if (local->rf_mode == NFC_RF_INITIATOR &&
addr->target_idx != local->target_idx) {
ret = -ENOLINK;
goto put_dev;
}
llcp_sock->dev = dev;
llcp_sock->local = nfc_llcp_local_get(local);
llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
if (llcp_sock->ssap == LLCP_SAP_MAX) {
nfc_llcp_local_put(llcp_sock->local);
llcp_sock->local = NULL;
ret = -ENOMEM;
goto put_dev;
}
llcp_sock->reserved_ssap = llcp_sock->ssap;
if (addr->service_name_len == 0)
llcp_sock->dsap = addr->dsap;
else
llcp_sock->dsap = LLCP_SAP_SDP;
llcp_sock->nfc_protocol = addr->nfc_protocol;
llcp_sock->service_name_len = min_t(unsigned int,
addr->service_name_len,
NFC_LLCP_MAX_SERVICE_NAME);
llcp_sock->service_name = kmemdup(addr->service_name,
llcp_sock->service_name_len,
GFP_KERNEL);
nfc_llcp_sock_link(&local->connecting_sockets, sk);
ret = nfc_llcp_send_connect(llcp_sock);
if (ret)
goto sock_unlink;
sk->sk_state = LLCP_CONNECTING;
ret = sock_wait_state(sk, LLCP_CONNECTED,
sock_sndtimeo(sk, flags & O_NONBLOCK));
if (ret && ret != -EINPROGRESS)
goto sock_unlink;
release_sock(sk);
return ret;
sock_unlink:
nfc_llcp_put_ssap(local, llcp_sock->ssap);
nfc_llcp_local_put(llcp_sock->local);
llcp_sock->local = NULL;
nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
kfree(llcp_sock->service_name);
llcp_sock->service_name = NULL;
put_dev:
nfc_put_device(dev);
error:
release_sock(sk);
return ret;
}
static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg,
size_t len)
{
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
int ret;
pr_debug("sock %p sk %p", sock, sk);
ret = sock_error(sk);
if (ret)
return ret;
if (msg->msg_flags & MSG_OOB)
return -EOPNOTSUPP;
lock_sock(sk);
if (!llcp_sock->local) {
release_sock(sk);
return -ENODEV;
}
if (sk->sk_type == SOCK_DGRAM) {
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr,
msg->msg_name);
if (msg->msg_namelen < sizeof(*addr)) {
release_sock(sk);
return -EINVAL;
}
release_sock(sk);
return nfc_llcp_send_ui_frame(llcp_sock, addr->dsap, addr->ssap,
msg, len);
}
if (sk->sk_state != LLCP_CONNECTED) {
release_sock(sk);
return -ENOTCONN;
}
release_sock(sk);
return nfc_llcp_send_i_frame(llcp_sock, msg, len);
}
static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg,
size_t len, int flags)
{
int noblock = flags & MSG_DONTWAIT;
struct sock *sk = sock->sk;
unsigned int copied, rlen;
struct sk_buff *skb, *cskb;
int err = 0;
pr_debug("%p %zu\n", sk, len);
lock_sock(sk);
if (sk->sk_state == LLCP_CLOSED &&
skb_queue_empty(&sk->sk_receive_queue)) {
release_sock(sk);
return 0;
}
release_sock(sk);
if (flags & (MSG_OOB))
return -EOPNOTSUPP;
skb = skb_recv_datagram(sk, flags, noblock, &err);
if (!skb) {
pr_err("Recv datagram failed state %d %d %d",
sk->sk_state, err, sock_error(sk));
if (sk->sk_shutdown & RCV_SHUTDOWN)
return 0;
return err;
}
rlen = skb->len; /* real length of skb */
copied = min_t(unsigned int, rlen, len);
cskb = skb;
if (skb_copy_datagram_msg(cskb, 0, msg, copied)) {
if (!(flags & MSG_PEEK))
skb_queue_head(&sk->sk_receive_queue, skb);
return -EFAULT;
}
sock_recv_timestamp(msg, sk, skb);
if (sk->sk_type == SOCK_DGRAM && msg->msg_name) {
struct nfc_llcp_ui_cb *ui_cb = nfc_llcp_ui_skb_cb(skb);
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, sockaddr,
msg->msg_name);
msg->msg_namelen = sizeof(struct sockaddr_nfc_llcp);
pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
memset(sockaddr, 0, sizeof(*sockaddr));
sockaddr->sa_family = AF_NFC;
sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
sockaddr->dsap = ui_cb->dsap;
sockaddr->ssap = ui_cb->ssap;
}
/* Mark read part of skb as used */
if (!(flags & MSG_PEEK)) {
/* SOCK_STREAM: re-queue skb if it contains unreceived data */
if (sk->sk_type == SOCK_STREAM ||
sk->sk_type == SOCK_DGRAM ||
sk->sk_type == SOCK_RAW) {
skb_pull(skb, copied);
if (skb->len) {
skb_queue_head(&sk->sk_receive_queue, skb);
goto done;
}
}
kfree_skb(skb);
}
/* XXX Queue backlogged skbs */
done:
/* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
copied = rlen;
return copied;
}
static const struct proto_ops llcp_sock_ops = {
.family = PF_NFC,
.owner = THIS_MODULE,
.bind = llcp_sock_bind,
.connect = llcp_sock_connect,
.release = llcp_sock_release,
.socketpair = sock_no_socketpair,
.accept = llcp_sock_accept,
.getname = llcp_sock_getname,
.poll = llcp_sock_poll,
.ioctl = sock_no_ioctl,
.listen = llcp_sock_listen,
.shutdown = sock_no_shutdown,
.setsockopt = nfc_llcp_setsockopt,
.getsockopt = nfc_llcp_getsockopt,
.sendmsg = llcp_sock_sendmsg,
.recvmsg = llcp_sock_recvmsg,
.mmap = sock_no_mmap,
};
static const struct proto_ops llcp_rawsock_ops = {
.family = PF_NFC,
.owner = THIS_MODULE,
.bind = llcp_raw_sock_bind,
.connect = sock_no_connect,
.release = llcp_sock_release,
.socketpair = sock_no_socketpair,
.accept = sock_no_accept,
.getname = llcp_sock_getname,
.poll = llcp_sock_poll,
.ioctl = sock_no_ioctl,
.listen = sock_no_listen,
.shutdown = sock_no_shutdown,
.setsockopt = sock_no_setsockopt,
.getsockopt = sock_no_getsockopt,
.sendmsg = sock_no_sendmsg,
.recvmsg = llcp_sock_recvmsg,
.mmap = sock_no_mmap,
};
static void llcp_sock_destruct(struct sock *sk)
{
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
pr_debug("%p\n", sk);
if (sk->sk_state == LLCP_CONNECTED)
nfc_put_device(llcp_sock->dev);
skb_queue_purge(&sk->sk_receive_queue);
nfc_llcp_sock_free(llcp_sock);
if (!sock_flag(sk, SOCK_DEAD)) {
pr_err("Freeing alive NFC LLCP socket %p\n", sk);
return;
}
}
struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp, int kern)
{
struct sock *sk;
struct nfc_llcp_sock *llcp_sock;
sk = sk_alloc(&init_net, PF_NFC, gfp, &llcp_sock_proto, kern);
if (!sk)
return NULL;
llcp_sock = nfc_llcp_sock(sk);
sock_init_data(sock, sk);
sk->sk_state = LLCP_CLOSED;
sk->sk_protocol = NFC_SOCKPROTO_LLCP;
sk->sk_type = type;
sk->sk_destruct = llcp_sock_destruct;
llcp_sock->ssap = 0;
llcp_sock->dsap = LLCP_SAP_SDP;
llcp_sock->rw = LLCP_MAX_RW + 1;
llcp_sock->miux = cpu_to_be16(LLCP_MAX_MIUX + 1);
llcp_sock->send_n = llcp_sock->send_ack_n = 0;
llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
llcp_sock->remote_ready = 1;
llcp_sock->reserved_ssap = LLCP_SAP_MAX;
nfc_llcp_socket_remote_param_init(llcp_sock);
skb_queue_head_init(&llcp_sock->tx_queue);
skb_queue_head_init(&llcp_sock->tx_pending_queue);
INIT_LIST_HEAD(&llcp_sock->accept_queue);
if (sock != NULL)
sock->state = SS_UNCONNECTED;
return sk;
}
void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
{
kfree(sock->service_name);
skb_queue_purge(&sock->tx_queue);
skb_queue_purge(&sock->tx_pending_queue);
list_del_init(&sock->accept_queue);
sock->parent = NULL;
nfc_llcp_local_put(sock->local);
}
static int llcp_sock_create(struct net *net, struct socket *sock,
const struct nfc_protocol *nfc_proto, int kern)
{
struct sock *sk;
pr_debug("%p\n", sock);
if (sock->type != SOCK_STREAM &&
sock->type != SOCK_DGRAM &&
sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT;
if (sock->type == SOCK_RAW) {
if (!capable(CAP_NET_RAW))
return -EPERM;
sock->ops = &llcp_rawsock_ops;
} else {
sock->ops = &llcp_sock_ops;
}
sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern);
if (sk == NULL)
return -ENOMEM;
return 0;
}
static const struct nfc_protocol llcp_nfc_proto = {
.id = NFC_SOCKPROTO_LLCP,
.proto = &llcp_sock_proto,
.owner = THIS_MODULE,
.create = llcp_sock_create
};
int __init nfc_llcp_sock_init(void)
{
return nfc_proto_register(&llcp_nfc_proto);
}
void nfc_llcp_sock_exit(void)
{
nfc_proto_unregister(&llcp_nfc_proto);
}