forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-10-09 244b2c5ca8b14627e4a17755e5922221e121c771 
 kernel/net/bluetooth/hci_sock.c
....@@ -23,7 +23,7 @@
2323 */
2424 
2525 /* Bluetooth HCI sockets. */
26
-
26
+#include <linux/compat.h>
2727 #include <linux/export.h>
2828 #include <linux/utsname.h>
2929 #include <linux/sched.h>
....@@ -52,7 +52,7 @@
5252 	struct bt_sock    bt;
5353 	struct hci_dev    *hdev;
5454 	struct hci_filter filter;
55
-	__u32             cmsg_mask;
55
+	__u8              cmsg_mask;
5656 	unsigned short    channel;
5757 	unsigned long     flags;
5858 	__u32             cookie;
....@@ -222,7 +222,8 @@
222222 			if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
223223 			    hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
224224 			    hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
225
-			    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
225
+			    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
226
+			    hci_skb_pkt_type(skb) != HCI_ISODATA_PKT)
226227 				continue;
227228 			if (is_filtered_packet(sk, skb))
228229 				continue;
....@@ -231,7 +232,8 @@
231232 				continue;
232233 			if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
233234 			    hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
234
-			    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
235
+			    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
236
+			    hci_skb_pkt_type(skb) != HCI_ISODATA_PKT)
235237 				continue;
236238 		} else {
237239 			/* Don't send frame to other channel types */
....@@ -334,6 +336,12 @@
334336 			opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
335337 		else
336338 			opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
339
+		break;
340
+	case HCI_ISODATA_PKT:
341
+		if (bt_cb(skb)->incoming)
342
+			opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT);
343
+		else
344
+			opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT);
337345 		break;
338346 	case HCI_DIAG_PKT:
339347 		opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
....@@ -446,8 +454,7 @@
446454 	case HCI_DEV_SETUP:
447455 		if (hdev->manufacturer == 0xffff)
448456 			return NULL;
449
-
450
-		/* fall through */
457
+		fallthrough;
451458 
452459 	case HCI_DEV_UP:
453460 		skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
....@@ -881,10 +888,6 @@
881888 	}
882889 
883890 	sock_orphan(sk);
884
-
885
-	skb_queue_purge(&sk->sk_receive_queue);
886
-	skb_queue_purge(&sk->sk_write_queue);
887
-
888891 	release_sock(sk);
889892 	sock_put(sk);
890893 	return 0;
....@@ -977,6 +980,34 @@
977980 
978981 	BT_DBG("cmd %x arg %lx", cmd, arg);
979982 
983
+	/* Make sure the cmd is valid before doing anything */
984
+	switch (cmd) {
985
+	case HCIGETDEVLIST:
986
+	case HCIGETDEVINFO:
987
+	case HCIGETCONNLIST:
988
+	case HCIDEVUP:
989
+	case HCIDEVDOWN:
990
+	case HCIDEVRESET:
991
+	case HCIDEVRESTAT:
992
+	case HCISETSCAN:
993
+	case HCISETAUTH:
994
+	case HCISETENCRYPT:
995
+	case HCISETPTYPE:
996
+	case HCISETLINKPOL:
997
+	case HCISETLINKMODE:
998
+	case HCISETACLMTU:
999
+	case HCISETSCOMTU:
1000
+	case HCIINQUIRY:
1001
+	case HCISETRAW:
1002
+	case HCIGETCONNINFO:
1003
+	case HCIGETAUTHINFO:
1004
+	case HCIBLOCKADDR:
1005
+	case HCIUNBLOCKADDR:
1006
+		break;
1007
+	default:
1008
+		return -ENOIOCTLCMD;
1009
+	}
1010
+
9801011 	lock_sock(sk);
9811012 
9821013 	if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
....@@ -993,7 +1024,14 @@
9931024 	if (hci_sock_gen_cookie(sk)) {
9941025 		struct sk_buff *skb;
9951026 
996
-		if (capable(CAP_NET_ADMIN))
1027
+		/* Perform careful checks before setting the HCI_SOCK_TRUSTED
1028
+		 * flag. Make sure that not only the current task but also
1029
+		 * the socket opener has the required capability, since
1030
+		 * privileged programs can be tricked into making ioctl calls
1031
+		 * on HCI sockets, and the socket should not be marked as
1032
+		 * trusted simply because the ioctl caller is privileged.
1033
+		 */
1034
+		if (sk_capable(sk, CAP_NET_ADMIN))
9971035 			hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
9981036 
9991037 		/* Send event to monitor */
....@@ -1061,6 +1099,22 @@
10611099 	release_sock(sk);
10621100 	return err;
10631101 }
1102
+
1103
+#ifdef CONFIG_COMPAT
1104
+static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd,
1105
+				 unsigned long arg)
1106
+{
1107
+	switch (cmd) {
1108
+	case HCIDEVUP:
1109
+	case HCIDEVDOWN:
1110
+	case HCIDEVRESET:
1111
+	case HCIDEVRESTAT:
1112
+		return hci_sock_ioctl(sock, cmd, arg);
1113
+	}
1114
+
1115
+	return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
1116
+}
1117
+#endif
10641118 
10651119 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
10661120 			 int addr_len)
....@@ -1392,7 +1446,7 @@
13921446 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
13931447 			  struct sk_buff *skb)
13941448 {
1395
-	__u32 mask = hci_pi(sk)->cmsg_mask;
1449
+	__u8 mask = hci_pi(sk)->cmsg_mask;
13961450 
13971451 	if (mask & HCI_CMSG_DIR) {
13981452 		int incoming = bt_cb(skb)->incoming;
....@@ -1402,9 +1456,9 @@
14021456 
14031457 	if (mask & HCI_CMSG_TSTAMP) {
14041458 #ifdef CONFIG_COMPAT
1405
-		struct compat_timeval ctv;
1459
+		struct old_timeval32 ctv;
14061460 #endif
1407
-		struct timeval tv;
1461
+		struct __kernel_old_timeval tv;
14081462 		void *data;
14091463 		int len;
14101464 
....@@ -1572,11 +1626,13 @@
15721626 		}
15731627 	}
15741628 
1575
-	no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1576
-	if (no_hdev != !hdev) {
1577
-		err = mgmt_cmd_status(sk, index, opcode,
1578
-				      MGMT_STATUS_INVALID_INDEX);
1579
-		goto done;
1629
+	if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) {
1630
+		no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1631
+		if (no_hdev != !hdev) {
1632
+			err = mgmt_cmd_status(sk, index, opcode,
1633
+					      MGMT_STATUS_INVALID_INDEX);
1634
+			goto done;
1635
+		}
15801636 	}
15811637 
15821638 	var_len = (handler->flags & HCI_MGMT_VAR_LEN);
....@@ -1766,7 +1822,8 @@
17661822 		 */
17671823 		if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
17681824 		    hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1769
-		    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1825
+		    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1826
+		    hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
17701827 			err = -EINVAL;
17711828 			goto drop;
17721829 		}
....@@ -1810,7 +1867,8 @@
18101867 		}
18111868 
18121869 		if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1813
-		    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1870
+		    hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1871
+		    hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
18141872 			err = -EINVAL;
18151873 			goto drop;
18161874 		}
....@@ -1831,7 +1889,7 @@
18311889 }
18321890 
18331891 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1834
-			       char __user *optval, unsigned int len)
1892
+			       sockptr_t optval, unsigned int len)
18351893 {
18361894 	struct hci_ufilter uf = { .opcode = 0 };
18371895 	struct sock *sk = sock->sk;
....@@ -1851,7 +1909,7 @@
18511909 
18521910 	switch (optname) {
18531911 	case HCI_DATA_DIR:
1854
-		if (get_user(opt, (int __user *)optval)) {
1912
+		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
18551913 			err = -EFAULT;
18561914 			break;
18571915 		}
....@@ -1863,7 +1921,7 @@
18631921 		break;
18641922 
18651923 	case HCI_TIME_STAMP:
1866
-		if (get_user(opt, (int __user *)optval)) {
1924
+		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
18671925 			err = -EFAULT;
18681926 			break;
18691927 		}
....@@ -1885,7 +1943,7 @@
18851943 		}
18861944 
18871945 		len = min_t(unsigned int, len, sizeof(uf));
1888
-		if (copy_from_user(&uf, optval, len)) {
1946
+		if (copy_from_sockptr(&uf, optval, len)) {
18891947 			err = -EFAULT;
18901948 			break;
18911949 		}
....@@ -1985,6 +2043,12 @@
19852043 	return err;
19862044 }
19872045 
2046
+static void hci_sock_destruct(struct sock *sk)
2047
+{
2048
+	skb_queue_purge(&sk->sk_receive_queue);
2049
+	skb_queue_purge(&sk->sk_write_queue);
2050
+}
2051
+
19882052 static const struct proto_ops hci_sock_ops = {
19892053 	.family		= PF_BLUETOOTH,
19902054 	.owner		= THIS_MODULE,
....@@ -1994,6 +2058,9 @@
19942058 	.sendmsg	= hci_sock_sendmsg,
19952059 	.recvmsg	= hci_sock_recvmsg,
19962060 	.ioctl		= hci_sock_ioctl,
2061
+#ifdef CONFIG_COMPAT
2062
+	.compat_ioctl	= hci_sock_compat_ioctl,
2063
+#endif
19972064 	.poll		= datagram_poll,
19982065 	.listen		= sock_no_listen,
19992066 	.shutdown	= sock_no_shutdown,
....@@ -2035,6 +2102,7 @@
20352102 
20362103 	sock->state = SS_UNCONNECTED;
20372104 	sk->sk_state = BT_OPEN;
2105
+	sk->sk_destruct = hci_sock_destruct;
20382106 
20392107 	bt_sock_link(&hci_sk_list, sk);
20402108 	return 0;