mirror of
https://github.com/torvalds/linux.git
synced 2024-12-06 11:01:43 +00:00
6709d4b7bc
This commit fixes several use-after-free that caused by function nfc_llcp_find_local(). For example, one UAF can happen when below buggy time window occurs. // nfc_genl_llc_get_params | // nfc_unregister_device | dev = nfc_get_device(idx); | device_lock(...) if (!dev) | dev->shutting_down = true; return -ENODEV; | device_unlock(...); | device_lock(...); | // nfc_llcp_unregister_device | nfc_llcp_find_local() nfc_llcp_find_local(...); | | local_cleanup() if (!local) { | rc = -ENODEV; | // nfc_llcp_local_put goto exit; | kref_put(.., local_release) } | | // local_release | list_del(&local->list) // nfc_genl_send_params | kfree() local->dev->idx !!!UAF!!! | | and the crash trace for the one of the discussed UAF like: BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 Read of size 8 at addr ffff888105b0e410 by task 20114 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:319 [inline] print_report+0xcc/0x620 mm/kasan/report.c:430 kasan_report+0xb2/0xe0 mm/kasan/report.c:536 nfc_genl_send_params net/nfc/netlink.c:999 [inline] nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968 genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b6/0x200 net/socket.c:747 ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555 __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f34640a2389 RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000 </TASK> Allocated by task 20116: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567 nfc_register_device+0x61/0x260 net/nfc/core.c:1124 nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257 virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148 misc_open+0x379/0x4a0 drivers/char/misc.c:165 chrdev_open+0x26c/0x780 fs/char_dev.c:414 do_dentry_open+0x6c4/0x12a0 fs/open.c:920 do_open fs/namei.c:3560 [inline] path_openat+0x24fe/0x37e0 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x171/0x4c0 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x143/0x200 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 20115: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x7a/0x190 mm/slub.c:3800 local_release net/nfc/llcp_core.c:174 [inline] kref_put include/linux/kref.h:65 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline] nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620 nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179 virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163 __fput+0x252/0xa20 fs/file_table.c:321 task_work_run+0x174/0x270 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc Last potentially related work creation: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491 kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328 drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735 unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773 unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753 neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895 addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684 notifier_call_chain+0xbe/0x210 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937 call_netdevice_notifiers_extack net/core/dev.c:1975 [inline] call_netdevice_notifiers net/core/dev.c:1989 [inline] dev_change_name+0x3c3/0x870 net/core/dev.c:1211 dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376 dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542 sock_do_ioctl+0x160/0x260 net/socket.c:1213 sock_ioctl+0x3f9/0x670 net/socket.c:1316 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888105b0e400 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff888105b0e400, ffff888105b0e800) The buggy address belongs to the physical page: head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10 raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb In summary, this patch solves those use-after-free by 1. Re-implement the nfc_llcp_find_local(). The current version does not grab the reference when getting the local from the linked list. For example, the llcp_sock_bind() gets the reference like below: // llcp_sock_bind() local = nfc_llcp_find_local(dev); // A ..... \ | raceable ..... / llcp_sock->local = nfc_llcp_local_get(local); // B There is an apparent race window that one can drop the reference and free the local object fetched in (A) before (B) gets the reference. 2. Some callers of the nfc_llcp_find_local() do not grab the reference at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions. We add the nfc_llcp_local_put() for them. Moreover, we add the necessary error handling function to put the reference. 3. Add the nfc_llcp_remove_local() helper. The local object is removed from the linked list in local_release() when all reference is gone. This patch removes it when nfc_llcp_unregister_device() is called. Therefore, every caller of nfc_llcp_find_local() will get a reference even when the nfc_llcp_unregister_device() is called. This promises no use-after-free for the local object is ever possible. Fixes:52feb444a9
("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support") Fixes:c7aa12252f
("NFC: Take a reference on the LLCP local pointer when creating a socket") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1062 lines
22 KiB
C
1062 lines
22 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Copyright (C) 2011 Intel Corporation. All rights reserved.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) "llcp: %s: " fmt, __func__
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/nfc.h>
|
|
#include <linux/sched/signal.h>
|
|
|
|
#include "nfc.h"
|
|
#include "llcp.h"
|
|
|
|
static int sock_wait_state(struct sock *sk, int state, unsigned long timeo)
|
|
{
|
|
DECLARE_WAITQUEUE(wait, current);
|
|
int err = 0;
|
|
|
|
pr_debug("sk %p", sk);
|
|
|
|
add_wait_queue(sk_sleep(sk), &wait);
|
|
set_current_state(TASK_INTERRUPTIBLE);
|
|
|
|
while (sk->sk_state != state) {
|
|
if (!timeo) {
|
|
err = -EINPROGRESS;
|
|
break;
|
|
}
|
|
|
|
if (signal_pending(current)) {
|
|
err = sock_intr_errno(timeo);
|
|
break;
|
|
}
|
|
|
|
release_sock(sk);
|
|
timeo = schedule_timeout(timeo);
|
|
lock_sock(sk);
|
|
set_current_state(TASK_INTERRUPTIBLE);
|
|
|
|
err = sock_error(sk);
|
|
if (err)
|
|
break;
|
|
}
|
|
|
|
__set_current_state(TASK_RUNNING);
|
|
remove_wait_queue(sk_sleep(sk), &wait);
|
|
return err;
|
|
}
|
|
|
|
static struct proto llcp_sock_proto = {
|
|
.name = "NFC_LLCP",
|
|
.owner = THIS_MODULE,
|
|
.obj_size = sizeof(struct nfc_llcp_sock),
|
|
};
|
|
|
|
static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
struct nfc_llcp_local *local;
|
|
struct nfc_dev *dev;
|
|
struct sockaddr_nfc_llcp llcp_addr;
|
|
int len, ret = 0;
|
|
|
|
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
|
|
addr->sa_family != AF_NFC)
|
|
return -EINVAL;
|
|
|
|
pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
|
|
|
|
memset(&llcp_addr, 0, sizeof(llcp_addr));
|
|
len = min_t(unsigned int, sizeof(llcp_addr), alen);
|
|
memcpy(&llcp_addr, addr, len);
|
|
|
|
/* This is going to be a listening socket, dsap must be 0 */
|
|
if (llcp_addr.dsap != 0)
|
|
return -EINVAL;
|
|
|
|
lock_sock(sk);
|
|
|
|
if (sk->sk_state != LLCP_CLOSED) {
|
|
ret = -EBADFD;
|
|
goto error;
|
|
}
|
|
|
|
dev = nfc_get_device(llcp_addr.dev_idx);
|
|
if (dev == NULL) {
|
|
ret = -ENODEV;
|
|
goto error;
|
|
}
|
|
|
|
local = nfc_llcp_find_local(dev);
|
|
if (local == NULL) {
|
|
ret = -ENODEV;
|
|
goto put_dev;
|
|
}
|
|
|
|
llcp_sock->dev = dev;
|
|
llcp_sock->local = local;
|
|
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
|
|
llcp_sock->service_name_len = min_t(unsigned int,
|
|
llcp_addr.service_name_len,
|
|
NFC_LLCP_MAX_SERVICE_NAME);
|
|
llcp_sock->service_name = kmemdup(llcp_addr.service_name,
|
|
llcp_sock->service_name_len,
|
|
GFP_KERNEL);
|
|
if (!llcp_sock->service_name) {
|
|
ret = -ENOMEM;
|
|
goto sock_llcp_put_local;
|
|
}
|
|
llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
|
|
if (llcp_sock->ssap == LLCP_SAP_MAX) {
|
|
ret = -EADDRINUSE;
|
|
goto free_service_name;
|
|
}
|
|
|
|
llcp_sock->reserved_ssap = llcp_sock->ssap;
|
|
|
|
nfc_llcp_sock_link(&local->sockets, sk);
|
|
|
|
pr_debug("Socket bound to SAP %d\n", llcp_sock->ssap);
|
|
|
|
sk->sk_state = LLCP_BOUND;
|
|
nfc_put_device(dev);
|
|
release_sock(sk);
|
|
|
|
return 0;
|
|
|
|
free_service_name:
|
|
kfree(llcp_sock->service_name);
|
|
llcp_sock->service_name = NULL;
|
|
|
|
sock_llcp_put_local:
|
|
nfc_llcp_local_put(llcp_sock->local);
|
|
llcp_sock->local = NULL;
|
|
llcp_sock->dev = NULL;
|
|
|
|
put_dev:
|
|
nfc_put_device(dev);
|
|
|
|
error:
|
|
release_sock(sk);
|
|
return ret;
|
|
}
|
|
|
|
static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
|
|
int alen)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
struct nfc_llcp_local *local;
|
|
struct nfc_dev *dev;
|
|
struct sockaddr_nfc_llcp llcp_addr;
|
|
int len, ret = 0;
|
|
|
|
if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
|
|
addr->sa_family != AF_NFC)
|
|
return -EINVAL;
|
|
|
|
pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
|
|
|
|
memset(&llcp_addr, 0, sizeof(llcp_addr));
|
|
len = min_t(unsigned int, sizeof(llcp_addr), alen);
|
|
memcpy(&llcp_addr, addr, len);
|
|
|
|
lock_sock(sk);
|
|
|
|
if (sk->sk_state != LLCP_CLOSED) {
|
|
ret = -EBADFD;
|
|
goto error;
|
|
}
|
|
|
|
dev = nfc_get_device(llcp_addr.dev_idx);
|
|
if (dev == NULL) {
|
|
ret = -ENODEV;
|
|
goto error;
|
|
}
|
|
|
|
local = nfc_llcp_find_local(dev);
|
|
if (local == NULL) {
|
|
ret = -ENODEV;
|
|
goto put_dev;
|
|
}
|
|
|
|
llcp_sock->dev = dev;
|
|
llcp_sock->local = local;
|
|
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
|
|
|
|
nfc_llcp_sock_link(&local->raw_sockets, sk);
|
|
|
|
sk->sk_state = LLCP_BOUND;
|
|
|
|
put_dev:
|
|
nfc_put_device(dev);
|
|
|
|
error:
|
|
release_sock(sk);
|
|
return ret;
|
|
}
|
|
|
|
static int llcp_sock_listen(struct socket *sock, int backlog)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
int ret = 0;
|
|
|
|
pr_debug("sk %p backlog %d\n", sk, backlog);
|
|
|
|
lock_sock(sk);
|
|
|
|
if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM) ||
|
|
sk->sk_state != LLCP_BOUND) {
|
|
ret = -EBADFD;
|
|
goto error;
|
|
}
|
|
|
|
sk->sk_max_ack_backlog = backlog;
|
|
sk->sk_ack_backlog = 0;
|
|
|
|
pr_debug("Socket listening\n");
|
|
sk->sk_state = LLCP_LISTEN;
|
|
|
|
error:
|
|
release_sock(sk);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
|
|
sockptr_t optval, unsigned int optlen)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
u32 opt;
|
|
int err = 0;
|
|
|
|
pr_debug("%p optname %d\n", sk, optname);
|
|
|
|
if (level != SOL_NFC)
|
|
return -ENOPROTOOPT;
|
|
|
|
lock_sock(sk);
|
|
|
|
switch (optname) {
|
|
case NFC_LLCP_RW:
|
|
if (sk->sk_state == LLCP_CONNECTED ||
|
|
sk->sk_state == LLCP_BOUND ||
|
|
sk->sk_state == LLCP_LISTEN) {
|
|
err = -EINVAL;
|
|
break;
|
|
}
|
|
|
|
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
|
|
err = -EFAULT;
|
|
break;
|
|
}
|
|
|
|
if (opt > LLCP_MAX_RW) {
|
|
err = -EINVAL;
|
|
break;
|
|
}
|
|
|
|
llcp_sock->rw = (u8) opt;
|
|
|
|
break;
|
|
|
|
case NFC_LLCP_MIUX:
|
|
if (sk->sk_state == LLCP_CONNECTED ||
|
|
sk->sk_state == LLCP_BOUND ||
|
|
sk->sk_state == LLCP_LISTEN) {
|
|
err = -EINVAL;
|
|
break;
|
|
}
|
|
|
|
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
|
|
err = -EFAULT;
|
|
break;
|
|
}
|
|
|
|
if (opt > LLCP_MAX_MIUX) {
|
|
err = -EINVAL;
|
|
break;
|
|
}
|
|
|
|
llcp_sock->miux = cpu_to_be16((u16) opt);
|
|
|
|
break;
|
|
|
|
default:
|
|
err = -ENOPROTOOPT;
|
|
break;
|
|
}
|
|
|
|
release_sock(sk);
|
|
|
|
pr_debug("%p rw %d miux %d\n", llcp_sock,
|
|
llcp_sock->rw, llcp_sock->miux);
|
|
|
|
return err;
|
|
}
|
|
|
|
static int nfc_llcp_getsockopt(struct socket *sock, int level, int optname,
|
|
char __user *optval, int __user *optlen)
|
|
{
|
|
struct nfc_llcp_local *local;
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
int len, err = 0;
|
|
u16 miux, remote_miu;
|
|
u8 rw;
|
|
|
|
pr_debug("%p optname %d\n", sk, optname);
|
|
|
|
if (level != SOL_NFC)
|
|
return -ENOPROTOOPT;
|
|
|
|
if (get_user(len, optlen))
|
|
return -EFAULT;
|
|
|
|
local = llcp_sock->local;
|
|
if (!local)
|
|
return -ENODEV;
|
|
|
|
len = min_t(u32, len, sizeof(u32));
|
|
|
|
lock_sock(sk);
|
|
|
|
switch (optname) {
|
|
case NFC_LLCP_RW:
|
|
rw = llcp_sock->rw > LLCP_MAX_RW ? local->rw : llcp_sock->rw;
|
|
if (put_user(rw, (u32 __user *) optval))
|
|
err = -EFAULT;
|
|
|
|
break;
|
|
|
|
case NFC_LLCP_MIUX:
|
|
miux = be16_to_cpu(llcp_sock->miux) > LLCP_MAX_MIUX ?
|
|
be16_to_cpu(local->miux) : be16_to_cpu(llcp_sock->miux);
|
|
|
|
if (put_user(miux, (u32 __user *) optval))
|
|
err = -EFAULT;
|
|
|
|
break;
|
|
|
|
case NFC_LLCP_REMOTE_MIU:
|
|
remote_miu = llcp_sock->remote_miu > LLCP_MAX_MIU ?
|
|
local->remote_miu : llcp_sock->remote_miu;
|
|
|
|
if (put_user(remote_miu, (u32 __user *) optval))
|
|
err = -EFAULT;
|
|
|
|
break;
|
|
|
|
case NFC_LLCP_REMOTE_LTO:
|
|
if (put_user(local->remote_lto / 10, (u32 __user *) optval))
|
|
err = -EFAULT;
|
|
|
|
break;
|
|
|
|
case NFC_LLCP_REMOTE_RW:
|
|
if (put_user(llcp_sock->remote_rw, (u32 __user *) optval))
|
|
err = -EFAULT;
|
|
|
|
break;
|
|
|
|
default:
|
|
err = -ENOPROTOOPT;
|
|
break;
|
|
}
|
|
|
|
release_sock(sk);
|
|
|
|
if (put_user(len, optlen))
|
|
return -EFAULT;
|
|
|
|
return err;
|
|
}
|
|
|
|
void nfc_llcp_accept_unlink(struct sock *sk)
|
|
{
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
|
|
pr_debug("state %d\n", sk->sk_state);
|
|
|
|
list_del_init(&llcp_sock->accept_queue);
|
|
sk_acceptq_removed(llcp_sock->parent);
|
|
llcp_sock->parent = NULL;
|
|
|
|
sock_put(sk);
|
|
}
|
|
|
|
void nfc_llcp_accept_enqueue(struct sock *parent, struct sock *sk)
|
|
{
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
struct nfc_llcp_sock *llcp_sock_parent = nfc_llcp_sock(parent);
|
|
|
|
/* Lock will be free from unlink */
|
|
sock_hold(sk);
|
|
|
|
list_add_tail(&llcp_sock->accept_queue,
|
|
&llcp_sock_parent->accept_queue);
|
|
llcp_sock->parent = parent;
|
|
sk_acceptq_added(parent);
|
|
}
|
|
|
|
struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
|
|
struct socket *newsock)
|
|
{
|
|
struct nfc_llcp_sock *lsk, *n, *llcp_parent;
|
|
struct sock *sk;
|
|
|
|
llcp_parent = nfc_llcp_sock(parent);
|
|
|
|
list_for_each_entry_safe(lsk, n, &llcp_parent->accept_queue,
|
|
accept_queue) {
|
|
sk = &lsk->sk;
|
|
lock_sock(sk);
|
|
|
|
if (sk->sk_state == LLCP_CLOSED) {
|
|
release_sock(sk);
|
|
nfc_llcp_accept_unlink(sk);
|
|
continue;
|
|
}
|
|
|
|
if (sk->sk_state == LLCP_CONNECTED || !newsock) {
|
|
list_del_init(&lsk->accept_queue);
|
|
sock_put(sk);
|
|
|
|
if (newsock)
|
|
sock_graft(sk, newsock);
|
|
|
|
release_sock(sk);
|
|
|
|
pr_debug("Returning sk state %d\n", sk->sk_state);
|
|
|
|
sk_acceptq_removed(parent);
|
|
|
|
return sk;
|
|
}
|
|
|
|
release_sock(sk);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static int llcp_sock_accept(struct socket *sock, struct socket *newsock,
|
|
int flags, bool kern)
|
|
{
|
|
DECLARE_WAITQUEUE(wait, current);
|
|
struct sock *sk = sock->sk, *new_sk;
|
|
long timeo;
|
|
int ret = 0;
|
|
|
|
pr_debug("parent %p\n", sk);
|
|
|
|
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
|
|
|
|
if (sk->sk_state != LLCP_LISTEN) {
|
|
ret = -EBADFD;
|
|
goto error;
|
|
}
|
|
|
|
timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
|
|
|
|
/* Wait for an incoming connection. */
|
|
add_wait_queue_exclusive(sk_sleep(sk), &wait);
|
|
while (!(new_sk = nfc_llcp_accept_dequeue(sk, newsock))) {
|
|
set_current_state(TASK_INTERRUPTIBLE);
|
|
|
|
if (!timeo) {
|
|
ret = -EAGAIN;
|
|
break;
|
|
}
|
|
|
|
if (signal_pending(current)) {
|
|
ret = sock_intr_errno(timeo);
|
|
break;
|
|
}
|
|
|
|
release_sock(sk);
|
|
timeo = schedule_timeout(timeo);
|
|
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
|
|
}
|
|
__set_current_state(TASK_RUNNING);
|
|
remove_wait_queue(sk_sleep(sk), &wait);
|
|
|
|
if (ret)
|
|
goto error;
|
|
|
|
newsock->state = SS_CONNECTED;
|
|
|
|
pr_debug("new socket %p\n", new_sk);
|
|
|
|
error:
|
|
release_sock(sk);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
|
|
int peer)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, llcp_addr, uaddr);
|
|
|
|
if (llcp_sock == NULL || llcp_sock->dev == NULL)
|
|
return -EBADFD;
|
|
|
|
pr_debug("%p %d %d %d\n", sk, llcp_sock->target_idx,
|
|
llcp_sock->dsap, llcp_sock->ssap);
|
|
|
|
memset(llcp_addr, 0, sizeof(*llcp_addr));
|
|
|
|
lock_sock(sk);
|
|
if (!llcp_sock->dev) {
|
|
release_sock(sk);
|
|
return -EBADFD;
|
|
}
|
|
llcp_addr->sa_family = AF_NFC;
|
|
llcp_addr->dev_idx = llcp_sock->dev->idx;
|
|
llcp_addr->target_idx = llcp_sock->target_idx;
|
|
llcp_addr->nfc_protocol = llcp_sock->nfc_protocol;
|
|
llcp_addr->dsap = llcp_sock->dsap;
|
|
llcp_addr->ssap = llcp_sock->ssap;
|
|
llcp_addr->service_name_len = llcp_sock->service_name_len;
|
|
memcpy(llcp_addr->service_name, llcp_sock->service_name,
|
|
llcp_addr->service_name_len);
|
|
release_sock(sk);
|
|
|
|
return sizeof(struct sockaddr_nfc_llcp);
|
|
}
|
|
|
|
static inline __poll_t llcp_accept_poll(struct sock *parent)
|
|
{
|
|
struct nfc_llcp_sock *llcp_sock, *parent_sock;
|
|
struct sock *sk;
|
|
|
|
parent_sock = nfc_llcp_sock(parent);
|
|
|
|
list_for_each_entry(llcp_sock, &parent_sock->accept_queue,
|
|
accept_queue) {
|
|
sk = &llcp_sock->sk;
|
|
|
|
if (sk->sk_state == LLCP_CONNECTED)
|
|
return EPOLLIN | EPOLLRDNORM;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
|
|
poll_table *wait)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
__poll_t mask = 0;
|
|
|
|
pr_debug("%p\n", sk);
|
|
|
|
sock_poll_wait(file, sock, wait);
|
|
|
|
if (sk->sk_state == LLCP_LISTEN)
|
|
return llcp_accept_poll(sk);
|
|
|
|
if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
|
|
mask |= EPOLLERR |
|
|
(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
|
|
|
|
if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
|
|
mask |= EPOLLIN | EPOLLRDNORM;
|
|
|
|
if (sk->sk_state == LLCP_CLOSED)
|
|
mask |= EPOLLHUP;
|
|
|
|
if (sk->sk_shutdown & RCV_SHUTDOWN)
|
|
mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
|
|
|
|
if (sk->sk_shutdown == SHUTDOWN_MASK)
|
|
mask |= EPOLLHUP;
|
|
|
|
if (sock_writeable(sk) && sk->sk_state == LLCP_CONNECTED)
|
|
mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
|
|
else
|
|
sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
|
|
|
|
pr_debug("mask 0x%x\n", mask);
|
|
|
|
return mask;
|
|
}
|
|
|
|
static int llcp_sock_release(struct socket *sock)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_local *local;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
int err = 0;
|
|
|
|
if (!sk)
|
|
return 0;
|
|
|
|
pr_debug("%p\n", sk);
|
|
|
|
local = llcp_sock->local;
|
|
if (local == NULL) {
|
|
err = -ENODEV;
|
|
goto out;
|
|
}
|
|
|
|
lock_sock(sk);
|
|
|
|
/* Send a DISC */
|
|
if (sk->sk_state == LLCP_CONNECTED)
|
|
nfc_llcp_send_disconnect(llcp_sock);
|
|
|
|
if (sk->sk_state == LLCP_LISTEN) {
|
|
struct nfc_llcp_sock *lsk, *n;
|
|
struct sock *accept_sk;
|
|
|
|
list_for_each_entry_safe(lsk, n, &llcp_sock->accept_queue,
|
|
accept_queue) {
|
|
accept_sk = &lsk->sk;
|
|
lock_sock(accept_sk);
|
|
|
|
nfc_llcp_send_disconnect(lsk);
|
|
nfc_llcp_accept_unlink(accept_sk);
|
|
|
|
release_sock(accept_sk);
|
|
}
|
|
}
|
|
|
|
if (sock->type == SOCK_RAW)
|
|
nfc_llcp_sock_unlink(&local->raw_sockets, sk);
|
|
else
|
|
nfc_llcp_sock_unlink(&local->sockets, sk);
|
|
|
|
if (llcp_sock->reserved_ssap < LLCP_SAP_MAX)
|
|
nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
|
|
|
|
release_sock(sk);
|
|
|
|
out:
|
|
sock_orphan(sk);
|
|
sock_put(sk);
|
|
|
|
return err;
|
|
}
|
|
|
|
static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
|
|
int len, int flags)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
struct sockaddr_nfc_llcp *addr = (struct sockaddr_nfc_llcp *)_addr;
|
|
struct nfc_dev *dev;
|
|
struct nfc_llcp_local *local;
|
|
int ret = 0;
|
|
|
|
pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
|
|
|
|
if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC)
|
|
return -EINVAL;
|
|
|
|
if (addr->service_name_len == 0 && addr->dsap == 0)
|
|
return -EINVAL;
|
|
|
|
pr_debug("addr dev_idx=%u target_idx=%u protocol=%u\n", addr->dev_idx,
|
|
addr->target_idx, addr->nfc_protocol);
|
|
|
|
lock_sock(sk);
|
|
|
|
if (sk->sk_state == LLCP_CONNECTED) {
|
|
ret = -EISCONN;
|
|
goto error;
|
|
}
|
|
if (sk->sk_state == LLCP_CONNECTING) {
|
|
ret = -EINPROGRESS;
|
|
goto error;
|
|
}
|
|
|
|
dev = nfc_get_device(addr->dev_idx);
|
|
if (dev == NULL) {
|
|
ret = -ENODEV;
|
|
goto error;
|
|
}
|
|
|
|
local = nfc_llcp_find_local(dev);
|
|
if (local == NULL) {
|
|
ret = -ENODEV;
|
|
goto put_dev;
|
|
}
|
|
|
|
device_lock(&dev->dev);
|
|
if (dev->dep_link_up == false) {
|
|
ret = -ENOLINK;
|
|
device_unlock(&dev->dev);
|
|
goto sock_llcp_put_local;
|
|
}
|
|
device_unlock(&dev->dev);
|
|
|
|
if (local->rf_mode == NFC_RF_INITIATOR &&
|
|
addr->target_idx != local->target_idx) {
|
|
ret = -ENOLINK;
|
|
goto sock_llcp_put_local;
|
|
}
|
|
|
|
llcp_sock->dev = dev;
|
|
llcp_sock->local = local;
|
|
llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
|
|
if (llcp_sock->ssap == LLCP_SAP_MAX) {
|
|
ret = -ENOMEM;
|
|
goto sock_llcp_nullify;
|
|
}
|
|
|
|
llcp_sock->reserved_ssap = llcp_sock->ssap;
|
|
|
|
if (addr->service_name_len == 0)
|
|
llcp_sock->dsap = addr->dsap;
|
|
else
|
|
llcp_sock->dsap = LLCP_SAP_SDP;
|
|
llcp_sock->nfc_protocol = addr->nfc_protocol;
|
|
llcp_sock->service_name_len = min_t(unsigned int,
|
|
addr->service_name_len,
|
|
NFC_LLCP_MAX_SERVICE_NAME);
|
|
llcp_sock->service_name = kmemdup(addr->service_name,
|
|
llcp_sock->service_name_len,
|
|
GFP_KERNEL);
|
|
if (!llcp_sock->service_name) {
|
|
ret = -ENOMEM;
|
|
goto sock_llcp_release;
|
|
}
|
|
|
|
nfc_llcp_sock_link(&local->connecting_sockets, sk);
|
|
|
|
ret = nfc_llcp_send_connect(llcp_sock);
|
|
if (ret)
|
|
goto sock_unlink;
|
|
|
|
sk->sk_state = LLCP_CONNECTING;
|
|
|
|
ret = sock_wait_state(sk, LLCP_CONNECTED,
|
|
sock_sndtimeo(sk, flags & O_NONBLOCK));
|
|
if (ret && ret != -EINPROGRESS)
|
|
goto sock_unlink;
|
|
|
|
release_sock(sk);
|
|
|
|
return ret;
|
|
|
|
sock_unlink:
|
|
nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
|
|
kfree(llcp_sock->service_name);
|
|
llcp_sock->service_name = NULL;
|
|
|
|
sock_llcp_release:
|
|
nfc_llcp_put_ssap(local, llcp_sock->ssap);
|
|
|
|
sock_llcp_nullify:
|
|
llcp_sock->local = NULL;
|
|
llcp_sock->dev = NULL;
|
|
|
|
sock_llcp_put_local:
|
|
nfc_llcp_local_put(local);
|
|
|
|
put_dev:
|
|
nfc_put_device(dev);
|
|
|
|
error:
|
|
release_sock(sk);
|
|
return ret;
|
|
}
|
|
|
|
static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg,
|
|
size_t len)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
int ret;
|
|
|
|
pr_debug("sock %p sk %p", sock, sk);
|
|
|
|
ret = sock_error(sk);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (msg->msg_flags & MSG_OOB)
|
|
return -EOPNOTSUPP;
|
|
|
|
lock_sock(sk);
|
|
|
|
if (!llcp_sock->local) {
|
|
release_sock(sk);
|
|
return -ENODEV;
|
|
}
|
|
|
|
if (sk->sk_type == SOCK_DGRAM) {
|
|
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr,
|
|
msg->msg_name);
|
|
|
|
if (msg->msg_namelen < sizeof(*addr)) {
|
|
release_sock(sk);
|
|
return -EINVAL;
|
|
}
|
|
|
|
release_sock(sk);
|
|
|
|
return nfc_llcp_send_ui_frame(llcp_sock, addr->dsap, addr->ssap,
|
|
msg, len);
|
|
}
|
|
|
|
if (sk->sk_state != LLCP_CONNECTED) {
|
|
release_sock(sk);
|
|
return -ENOTCONN;
|
|
}
|
|
|
|
release_sock(sk);
|
|
|
|
return nfc_llcp_send_i_frame(llcp_sock, msg, len);
|
|
}
|
|
|
|
static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg,
|
|
size_t len, int flags)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
unsigned int copied, rlen;
|
|
struct sk_buff *skb, *cskb;
|
|
int err = 0;
|
|
|
|
pr_debug("%p %zu\n", sk, len);
|
|
|
|
lock_sock(sk);
|
|
|
|
if (sk->sk_state == LLCP_CLOSED &&
|
|
skb_queue_empty(&sk->sk_receive_queue)) {
|
|
release_sock(sk);
|
|
return 0;
|
|
}
|
|
|
|
release_sock(sk);
|
|
|
|
if (flags & (MSG_OOB))
|
|
return -EOPNOTSUPP;
|
|
|
|
skb = skb_recv_datagram(sk, flags, &err);
|
|
if (!skb) {
|
|
pr_err("Recv datagram failed state %d %d %d",
|
|
sk->sk_state, err, sock_error(sk));
|
|
|
|
if (sk->sk_shutdown & RCV_SHUTDOWN)
|
|
return 0;
|
|
|
|
return err;
|
|
}
|
|
|
|
rlen = skb->len; /* real length of skb */
|
|
copied = min_t(unsigned int, rlen, len);
|
|
|
|
cskb = skb;
|
|
if (skb_copy_datagram_msg(cskb, 0, msg, copied)) {
|
|
if (!(flags & MSG_PEEK))
|
|
skb_queue_head(&sk->sk_receive_queue, skb);
|
|
return -EFAULT;
|
|
}
|
|
|
|
sock_recv_timestamp(msg, sk, skb);
|
|
|
|
if (sk->sk_type == SOCK_DGRAM && msg->msg_name) {
|
|
struct nfc_llcp_ui_cb *ui_cb = nfc_llcp_ui_skb_cb(skb);
|
|
DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, sockaddr,
|
|
msg->msg_name);
|
|
|
|
msg->msg_namelen = sizeof(struct sockaddr_nfc_llcp);
|
|
|
|
pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
|
|
|
|
memset(sockaddr, 0, sizeof(*sockaddr));
|
|
sockaddr->sa_family = AF_NFC;
|
|
sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
|
|
sockaddr->dsap = ui_cb->dsap;
|
|
sockaddr->ssap = ui_cb->ssap;
|
|
}
|
|
|
|
/* Mark read part of skb as used */
|
|
if (!(flags & MSG_PEEK)) {
|
|
|
|
/* SOCK_STREAM: re-queue skb if it contains unreceived data */
|
|
if (sk->sk_type == SOCK_STREAM ||
|
|
sk->sk_type == SOCK_DGRAM ||
|
|
sk->sk_type == SOCK_RAW) {
|
|
skb_pull(skb, copied);
|
|
if (skb->len) {
|
|
skb_queue_head(&sk->sk_receive_queue, skb);
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
kfree_skb(skb);
|
|
}
|
|
|
|
/* XXX Queue backlogged skbs */
|
|
|
|
done:
|
|
/* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
|
|
if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
|
|
copied = rlen;
|
|
|
|
return copied;
|
|
}
|
|
|
|
static const struct proto_ops llcp_sock_ops = {
|
|
.family = PF_NFC,
|
|
.owner = THIS_MODULE,
|
|
.bind = llcp_sock_bind,
|
|
.connect = llcp_sock_connect,
|
|
.release = llcp_sock_release,
|
|
.socketpair = sock_no_socketpair,
|
|
.accept = llcp_sock_accept,
|
|
.getname = llcp_sock_getname,
|
|
.poll = llcp_sock_poll,
|
|
.ioctl = sock_no_ioctl,
|
|
.listen = llcp_sock_listen,
|
|
.shutdown = sock_no_shutdown,
|
|
.setsockopt = nfc_llcp_setsockopt,
|
|
.getsockopt = nfc_llcp_getsockopt,
|
|
.sendmsg = llcp_sock_sendmsg,
|
|
.recvmsg = llcp_sock_recvmsg,
|
|
.mmap = sock_no_mmap,
|
|
};
|
|
|
|
static const struct proto_ops llcp_rawsock_ops = {
|
|
.family = PF_NFC,
|
|
.owner = THIS_MODULE,
|
|
.bind = llcp_raw_sock_bind,
|
|
.connect = sock_no_connect,
|
|
.release = llcp_sock_release,
|
|
.socketpair = sock_no_socketpair,
|
|
.accept = sock_no_accept,
|
|
.getname = llcp_sock_getname,
|
|
.poll = llcp_sock_poll,
|
|
.ioctl = sock_no_ioctl,
|
|
.listen = sock_no_listen,
|
|
.shutdown = sock_no_shutdown,
|
|
.sendmsg = sock_no_sendmsg,
|
|
.recvmsg = llcp_sock_recvmsg,
|
|
.mmap = sock_no_mmap,
|
|
};
|
|
|
|
static void llcp_sock_destruct(struct sock *sk)
|
|
{
|
|
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
|
|
|
|
pr_debug("%p\n", sk);
|
|
|
|
if (sk->sk_state == LLCP_CONNECTED)
|
|
nfc_put_device(llcp_sock->dev);
|
|
|
|
skb_queue_purge(&sk->sk_receive_queue);
|
|
|
|
nfc_llcp_sock_free(llcp_sock);
|
|
|
|
if (!sock_flag(sk, SOCK_DEAD)) {
|
|
pr_err("Freeing alive NFC LLCP socket %p\n", sk);
|
|
return;
|
|
}
|
|
}
|
|
|
|
struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp, int kern)
|
|
{
|
|
struct sock *sk;
|
|
struct nfc_llcp_sock *llcp_sock;
|
|
|
|
sk = sk_alloc(&init_net, PF_NFC, gfp, &llcp_sock_proto, kern);
|
|
if (!sk)
|
|
return NULL;
|
|
|
|
llcp_sock = nfc_llcp_sock(sk);
|
|
|
|
sock_init_data(sock, sk);
|
|
sk->sk_state = LLCP_CLOSED;
|
|
sk->sk_protocol = NFC_SOCKPROTO_LLCP;
|
|
sk->sk_type = type;
|
|
sk->sk_destruct = llcp_sock_destruct;
|
|
|
|
llcp_sock->ssap = 0;
|
|
llcp_sock->dsap = LLCP_SAP_SDP;
|
|
llcp_sock->rw = LLCP_MAX_RW + 1;
|
|
llcp_sock->miux = cpu_to_be16(LLCP_MAX_MIUX + 1);
|
|
llcp_sock->send_n = llcp_sock->send_ack_n = 0;
|
|
llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
|
|
llcp_sock->remote_ready = 1;
|
|
llcp_sock->reserved_ssap = LLCP_SAP_MAX;
|
|
nfc_llcp_socket_remote_param_init(llcp_sock);
|
|
skb_queue_head_init(&llcp_sock->tx_queue);
|
|
skb_queue_head_init(&llcp_sock->tx_pending_queue);
|
|
INIT_LIST_HEAD(&llcp_sock->accept_queue);
|
|
|
|
if (sock != NULL)
|
|
sock->state = SS_UNCONNECTED;
|
|
|
|
return sk;
|
|
}
|
|
|
|
void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
|
|
{
|
|
kfree(sock->service_name);
|
|
|
|
skb_queue_purge(&sock->tx_queue);
|
|
skb_queue_purge(&sock->tx_pending_queue);
|
|
|
|
list_del_init(&sock->accept_queue);
|
|
|
|
sock->parent = NULL;
|
|
|
|
nfc_llcp_local_put(sock->local);
|
|
}
|
|
|
|
static int llcp_sock_create(struct net *net, struct socket *sock,
|
|
const struct nfc_protocol *nfc_proto, int kern)
|
|
{
|
|
struct sock *sk;
|
|
|
|
pr_debug("%p\n", sock);
|
|
|
|
if (sock->type != SOCK_STREAM &&
|
|
sock->type != SOCK_DGRAM &&
|
|
sock->type != SOCK_RAW)
|
|
return -ESOCKTNOSUPPORT;
|
|
|
|
if (sock->type == SOCK_RAW) {
|
|
if (!capable(CAP_NET_RAW))
|
|
return -EPERM;
|
|
sock->ops = &llcp_rawsock_ops;
|
|
} else {
|
|
sock->ops = &llcp_sock_ops;
|
|
}
|
|
|
|
sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern);
|
|
if (sk == NULL)
|
|
return -ENOMEM;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct nfc_protocol llcp_nfc_proto = {
|
|
.id = NFC_SOCKPROTO_LLCP,
|
|
.proto = &llcp_sock_proto,
|
|
.owner = THIS_MODULE,
|
|
.create = llcp_sock_create
|
|
};
|
|
|
|
int __init nfc_llcp_sock_init(void)
|
|
{
|
|
return nfc_proto_register(&llcp_nfc_proto);
|
|
}
|
|
|
|
void nfc_llcp_sock_exit(void)
|
|
{
|
|
nfc_proto_unregister(&llcp_nfc_proto);
|
|
}
|