Loading...
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
26*/
27
28/* Bluetooth L2CAP sockets. */
29
30#include <linux/module.h>
31#include <linux/export.h>
32#include <linux/sched/signal.h>
33
34#include <net/bluetooth/bluetooth.h>
35#include <net/bluetooth/hci_core.h>
36#include <net/bluetooth/l2cap.h>
37
38#include "smp.h"
39
40static struct bt_sock_list l2cap_sk_list = {
41 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
42};
43
44static const struct proto_ops l2cap_sock_ops;
45static void l2cap_sock_init(struct sock *sk, struct sock *parent);
46static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
47 int proto, gfp_t prio, int kern);
48
49bool l2cap_is_socket(struct socket *sock)
50{
51 return sock && sock->ops == &l2cap_sock_ops;
52}
53EXPORT_SYMBOL(l2cap_is_socket);
54
55static int l2cap_validate_bredr_psm(u16 psm)
56{
57 /* PSM must be odd and lsb of upper byte must be 0 */
58 if ((psm & 0x0101) != 0x0001)
59 return -EINVAL;
60
61 /* Restrict usage of well-known PSMs */
62 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
63 return -EACCES;
64
65 return 0;
66}
67
68static int l2cap_validate_le_psm(u16 psm)
69{
70 /* Valid LE_PSM ranges are defined only until 0x00ff */
71 if (psm > L2CAP_PSM_LE_DYN_END)
72 return -EINVAL;
73
74 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
75 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
76 return -EACCES;
77
78 return 0;
79}
80
81static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82{
83 struct sock *sk = sock->sk;
84 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
85 struct sockaddr_l2 la;
86 int len, err = 0;
87
88 BT_DBG("sk %p", sk);
89
90 if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
91 addr->sa_family != AF_BLUETOOTH)
92 return -EINVAL;
93
94 memset(&la, 0, sizeof(la));
95 len = min_t(unsigned int, sizeof(la), alen);
96 memcpy(&la, addr, len);
97
98 if (la.l2_cid && la.l2_psm)
99 return -EINVAL;
100
101 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
102 return -EINVAL;
103
104 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
105 /* We only allow ATT user space socket */
106 if (la.l2_cid &&
107 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
108 return -EINVAL;
109 }
110
111 lock_sock(sk);
112
113 if (sk->sk_state != BT_OPEN) {
114 err = -EBADFD;
115 goto done;
116 }
117
118 if (la.l2_psm) {
119 __u16 psm = __le16_to_cpu(la.l2_psm);
120
121 if (la.l2_bdaddr_type == BDADDR_BREDR)
122 err = l2cap_validate_bredr_psm(psm);
123 else
124 err = l2cap_validate_le_psm(psm);
125
126 if (err)
127 goto done;
128 }
129
130 bacpy(&chan->src, &la.l2_bdaddr);
131 chan->src_type = la.l2_bdaddr_type;
132
133 if (la.l2_cid)
134 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
135 else
136 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
137
138 if (err < 0)
139 goto done;
140
141 switch (chan->chan_type) {
142 case L2CAP_CHAN_CONN_LESS:
143 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
144 chan->sec_level = BT_SECURITY_SDP;
145 break;
146 case L2CAP_CHAN_CONN_ORIENTED:
147 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
148 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
149 chan->sec_level = BT_SECURITY_SDP;
150 break;
151 case L2CAP_CHAN_RAW:
152 chan->sec_level = BT_SECURITY_SDP;
153 break;
154 case L2CAP_CHAN_FIXED:
155 /* Fixed channels default to the L2CAP core not holding a
156 * hci_conn reference for them. For fixed channels mapping to
157 * L2CAP sockets we do want to hold a reference so set the
158 * appropriate flag to request it.
159 */
160 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
161 break;
162 }
163
164 if (chan->psm && bdaddr_type_is_le(chan->src_type))
165 chan->mode = L2CAP_MODE_LE_FLOWCTL;
166
167 chan->state = BT_BOUND;
168 sk->sk_state = BT_BOUND;
169
170done:
171 release_sock(sk);
172 return err;
173}
174
175static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
176 int alen, int flags)
177{
178 struct sock *sk = sock->sk;
179 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
180 struct sockaddr_l2 la;
181 int len, err = 0;
182
183 BT_DBG("sk %p", sk);
184
185 if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
186 addr->sa_family != AF_BLUETOOTH)
187 return -EINVAL;
188
189 memset(&la, 0, sizeof(la));
190 len = min_t(unsigned int, sizeof(la), alen);
191 memcpy(&la, addr, len);
192
193 if (la.l2_cid && la.l2_psm)
194 return -EINVAL;
195
196 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
197 return -EINVAL;
198
199 /* Check that the socket wasn't bound to something that
200 * conflicts with the address given to connect(). If chan->src
201 * is BDADDR_ANY it means bind() was never used, in which case
202 * chan->src_type and la.l2_bdaddr_type do not need to match.
203 */
204 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
205 bdaddr_type_is_le(la.l2_bdaddr_type)) {
206 /* Old user space versions will try to incorrectly bind
207 * the ATT socket using BDADDR_BREDR. We need to accept
208 * this and fix up the source address type only when
209 * both the source CID and destination CID indicate
210 * ATT. Anything else is an invalid combination.
211 */
212 if (chan->scid != L2CAP_CID_ATT ||
213 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
214 return -EINVAL;
215
216 /* We don't have the hdev available here to make a
217 * better decision on random vs public, but since all
218 * user space versions that exhibit this issue anyway do
219 * not support random local addresses assuming public
220 * here is good enough.
221 */
222 chan->src_type = BDADDR_LE_PUBLIC;
223 }
224
225 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
226 return -EINVAL;
227
228 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
229 /* We only allow ATT user space socket */
230 if (la.l2_cid &&
231 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
232 return -EINVAL;
233 }
234
235 if (chan->psm && bdaddr_type_is_le(chan->src_type))
236 chan->mode = L2CAP_MODE_LE_FLOWCTL;
237
238 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
239 &la.l2_bdaddr, la.l2_bdaddr_type);
240 if (err)
241 return err;
242
243 lock_sock(sk);
244
245 err = bt_sock_wait_state(sk, BT_CONNECTED,
246 sock_sndtimeo(sk, flags & O_NONBLOCK));
247
248 release_sock(sk);
249
250 return err;
251}
252
253static int l2cap_sock_listen(struct socket *sock, int backlog)
254{
255 struct sock *sk = sock->sk;
256 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
257 int err = 0;
258
259 BT_DBG("sk %p backlog %d", sk, backlog);
260
261 lock_sock(sk);
262
263 if (sk->sk_state != BT_BOUND) {
264 err = -EBADFD;
265 goto done;
266 }
267
268 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
269 err = -EINVAL;
270 goto done;
271 }
272
273 switch (chan->mode) {
274 case L2CAP_MODE_BASIC:
275 case L2CAP_MODE_LE_FLOWCTL:
276 break;
277 case L2CAP_MODE_ERTM:
278 case L2CAP_MODE_STREAMING:
279 if (!disable_ertm)
280 break;
281 /* fall through */
282 default:
283 err = -EOPNOTSUPP;
284 goto done;
285 }
286
287 sk->sk_max_ack_backlog = backlog;
288 sk->sk_ack_backlog = 0;
289
290 /* Listening channels need to use nested locking in order not to
291 * cause lockdep warnings when the created child channels end up
292 * being locked in the same thread as the parent channel.
293 */
294 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
295
296 chan->state = BT_LISTEN;
297 sk->sk_state = BT_LISTEN;
298
299done:
300 release_sock(sk);
301 return err;
302}
303
304static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
305 int flags, bool kern)
306{
307 DEFINE_WAIT_FUNC(wait, woken_wake_function);
308 struct sock *sk = sock->sk, *nsk;
309 long timeo;
310 int err = 0;
311
312 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
313
314 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
315
316 BT_DBG("sk %p timeo %ld", sk, timeo);
317
318 /* Wait for an incoming connection. (wake-one). */
319 add_wait_queue_exclusive(sk_sleep(sk), &wait);
320 while (1) {
321 if (sk->sk_state != BT_LISTEN) {
322 err = -EBADFD;
323 break;
324 }
325
326 nsk = bt_accept_dequeue(sk, newsock);
327 if (nsk)
328 break;
329
330 if (!timeo) {
331 err = -EAGAIN;
332 break;
333 }
334
335 if (signal_pending(current)) {
336 err = sock_intr_errno(timeo);
337 break;
338 }
339
340 release_sock(sk);
341
342 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
343
344 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
345 }
346 remove_wait_queue(sk_sleep(sk), &wait);
347
348 if (err)
349 goto done;
350
351 newsock->state = SS_CONNECTED;
352
353 BT_DBG("new socket %p", nsk);
354
355done:
356 release_sock(sk);
357 return err;
358}
359
360static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
361 int peer)
362{
363 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
364 struct sock *sk = sock->sk;
365 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
366
367 BT_DBG("sock %p, sk %p", sock, sk);
368
369 if (peer && sk->sk_state != BT_CONNECTED &&
370 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
371 sk->sk_state != BT_CONFIG)
372 return -ENOTCONN;
373
374 memset(la, 0, sizeof(struct sockaddr_l2));
375 addr->sa_family = AF_BLUETOOTH;
376
377 la->l2_psm = chan->psm;
378
379 if (peer) {
380 bacpy(&la->l2_bdaddr, &chan->dst);
381 la->l2_cid = cpu_to_le16(chan->dcid);
382 la->l2_bdaddr_type = chan->dst_type;
383 } else {
384 bacpy(&la->l2_bdaddr, &chan->src);
385 la->l2_cid = cpu_to_le16(chan->scid);
386 la->l2_bdaddr_type = chan->src_type;
387 }
388
389 return sizeof(struct sockaddr_l2);
390}
391
392static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
393 char __user *optval, int __user *optlen)
394{
395 struct sock *sk = sock->sk;
396 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
397 struct l2cap_options opts;
398 struct l2cap_conninfo cinfo;
399 int len, err = 0;
400 u32 opt;
401
402 BT_DBG("sk %p", sk);
403
404 if (get_user(len, optlen))
405 return -EFAULT;
406
407 lock_sock(sk);
408
409 switch (optname) {
410 case L2CAP_OPTIONS:
411 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
412 * legacy ATT code depends on getsockopt for
413 * L2CAP_OPTIONS we need to let this pass.
414 */
415 if (bdaddr_type_is_le(chan->src_type) &&
416 chan->scid != L2CAP_CID_ATT) {
417 err = -EINVAL;
418 break;
419 }
420
421 memset(&opts, 0, sizeof(opts));
422 opts.imtu = chan->imtu;
423 opts.omtu = chan->omtu;
424 opts.flush_to = chan->flush_to;
425 opts.mode = chan->mode;
426 opts.fcs = chan->fcs;
427 opts.max_tx = chan->max_tx;
428 opts.txwin_size = chan->tx_win;
429
430 len = min_t(unsigned int, len, sizeof(opts));
431 if (copy_to_user(optval, (char *) &opts, len))
432 err = -EFAULT;
433
434 break;
435
436 case L2CAP_LM:
437 switch (chan->sec_level) {
438 case BT_SECURITY_LOW:
439 opt = L2CAP_LM_AUTH;
440 break;
441 case BT_SECURITY_MEDIUM:
442 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 break;
444 case BT_SECURITY_HIGH:
445 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
446 L2CAP_LM_SECURE;
447 break;
448 case BT_SECURITY_FIPS:
449 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
450 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
451 break;
452 default:
453 opt = 0;
454 break;
455 }
456
457 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
458 opt |= L2CAP_LM_MASTER;
459
460 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
461 opt |= L2CAP_LM_RELIABLE;
462
463 if (put_user(opt, (u32 __user *) optval))
464 err = -EFAULT;
465
466 break;
467
468 case L2CAP_CONNINFO:
469 if (sk->sk_state != BT_CONNECTED &&
470 !(sk->sk_state == BT_CONNECT2 &&
471 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
472 err = -ENOTCONN;
473 break;
474 }
475
476 memset(&cinfo, 0, sizeof(cinfo));
477 cinfo.hci_handle = chan->conn->hcon->handle;
478 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
479
480 len = min_t(unsigned int, len, sizeof(cinfo));
481 if (copy_to_user(optval, (char *) &cinfo, len))
482 err = -EFAULT;
483
484 break;
485
486 default:
487 err = -ENOPROTOOPT;
488 break;
489 }
490
491 release_sock(sk);
492 return err;
493}
494
495static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
496 char __user *optval, int __user *optlen)
497{
498 struct sock *sk = sock->sk;
499 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
500 struct bt_security sec;
501 struct bt_power pwr;
502 int len, err = 0;
503
504 BT_DBG("sk %p", sk);
505
506 if (level == SOL_L2CAP)
507 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508
509 if (level != SOL_BLUETOOTH)
510 return -ENOPROTOOPT;
511
512 if (get_user(len, optlen))
513 return -EFAULT;
514
515 lock_sock(sk);
516
517 switch (optname) {
518 case BT_SECURITY:
519 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
520 chan->chan_type != L2CAP_CHAN_FIXED &&
521 chan->chan_type != L2CAP_CHAN_RAW) {
522 err = -EINVAL;
523 break;
524 }
525
526 memset(&sec, 0, sizeof(sec));
527 if (chan->conn) {
528 sec.level = chan->conn->hcon->sec_level;
529
530 if (sk->sk_state == BT_CONNECTED)
531 sec.key_size = chan->conn->hcon->enc_key_size;
532 } else {
533 sec.level = chan->sec_level;
534 }
535
536 len = min_t(unsigned int, len, sizeof(sec));
537 if (copy_to_user(optval, (char *) &sec, len))
538 err = -EFAULT;
539
540 break;
541
542 case BT_DEFER_SETUP:
543 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
544 err = -EINVAL;
545 break;
546 }
547
548 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
549 (u32 __user *) optval))
550 err = -EFAULT;
551
552 break;
553
554 case BT_FLUSHABLE:
555 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
556 (u32 __user *) optval))
557 err = -EFAULT;
558
559 break;
560
561 case BT_POWER:
562 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
563 && sk->sk_type != SOCK_RAW) {
564 err = -EINVAL;
565 break;
566 }
567
568 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
569
570 len = min_t(unsigned int, len, sizeof(pwr));
571 if (copy_to_user(optval, (char *) &pwr, len))
572 err = -EFAULT;
573
574 break;
575
576 case BT_CHANNEL_POLICY:
577 if (put_user(chan->chan_policy, (u32 __user *) optval))
578 err = -EFAULT;
579 break;
580
581 case BT_SNDMTU:
582 if (!bdaddr_type_is_le(chan->src_type)) {
583 err = -EINVAL;
584 break;
585 }
586
587 if (sk->sk_state != BT_CONNECTED) {
588 err = -ENOTCONN;
589 break;
590 }
591
592 if (put_user(chan->omtu, (u16 __user *) optval))
593 err = -EFAULT;
594 break;
595
596 case BT_RCVMTU:
597 if (!bdaddr_type_is_le(chan->src_type)) {
598 err = -EINVAL;
599 break;
600 }
601
602 if (put_user(chan->imtu, (u16 __user *) optval))
603 err = -EFAULT;
604 break;
605
606 default:
607 err = -ENOPROTOOPT;
608 break;
609 }
610
611 release_sock(sk);
612 return err;
613}
614
615static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616{
617 switch (chan->scid) {
618 case L2CAP_CID_ATT:
619 if (mtu < L2CAP_LE_MIN_MTU)
620 return false;
621 break;
622
623 default:
624 if (mtu < L2CAP_DEFAULT_MIN_MTU)
625 return false;
626 }
627
628 return true;
629}
630
631static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
632 char __user *optval, unsigned int optlen)
633{
634 struct sock *sk = sock->sk;
635 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
636 struct l2cap_options opts;
637 int len, err = 0;
638 u32 opt;
639
640 BT_DBG("sk %p", sk);
641
642 lock_sock(sk);
643
644 switch (optname) {
645 case L2CAP_OPTIONS:
646 if (bdaddr_type_is_le(chan->src_type)) {
647 err = -EINVAL;
648 break;
649 }
650
651 if (sk->sk_state == BT_CONNECTED) {
652 err = -EINVAL;
653 break;
654 }
655
656 opts.imtu = chan->imtu;
657 opts.omtu = chan->omtu;
658 opts.flush_to = chan->flush_to;
659 opts.mode = chan->mode;
660 opts.fcs = chan->fcs;
661 opts.max_tx = chan->max_tx;
662 opts.txwin_size = chan->tx_win;
663
664 len = min_t(unsigned int, sizeof(opts), optlen);
665 if (copy_from_user((char *) &opts, optval, len)) {
666 err = -EFAULT;
667 break;
668 }
669
670 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
671 err = -EINVAL;
672 break;
673 }
674
675 if (!l2cap_valid_mtu(chan, opts.imtu)) {
676 err = -EINVAL;
677 break;
678 }
679
680 chan->mode = opts.mode;
681 switch (chan->mode) {
682 case L2CAP_MODE_LE_FLOWCTL:
683 break;
684 case L2CAP_MODE_BASIC:
685 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
686 break;
687 case L2CAP_MODE_ERTM:
688 case L2CAP_MODE_STREAMING:
689 if (!disable_ertm)
690 break;
691 /* fall through */
692 default:
693 err = -EINVAL;
694 break;
695 }
696
697 chan->imtu = opts.imtu;
698 chan->omtu = opts.omtu;
699 chan->fcs = opts.fcs;
700 chan->max_tx = opts.max_tx;
701 chan->tx_win = opts.txwin_size;
702 chan->flush_to = opts.flush_to;
703 break;
704
705 case L2CAP_LM:
706 if (get_user(opt, (u32 __user *) optval)) {
707 err = -EFAULT;
708 break;
709 }
710
711 if (opt & L2CAP_LM_FIPS) {
712 err = -EINVAL;
713 break;
714 }
715
716 if (opt & L2CAP_LM_AUTH)
717 chan->sec_level = BT_SECURITY_LOW;
718 if (opt & L2CAP_LM_ENCRYPT)
719 chan->sec_level = BT_SECURITY_MEDIUM;
720 if (opt & L2CAP_LM_SECURE)
721 chan->sec_level = BT_SECURITY_HIGH;
722
723 if (opt & L2CAP_LM_MASTER)
724 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 else
726 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
727
728 if (opt & L2CAP_LM_RELIABLE)
729 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 else
731 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
732 break;
733
734 default:
735 err = -ENOPROTOOPT;
736 break;
737 }
738
739 release_sock(sk);
740 return err;
741}
742
743static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
744 char __user *optval, unsigned int optlen)
745{
746 struct sock *sk = sock->sk;
747 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
748 struct bt_security sec;
749 struct bt_power pwr;
750 struct l2cap_conn *conn;
751 int len, err = 0;
752 u32 opt;
753
754 BT_DBG("sk %p", sk);
755
756 if (level == SOL_L2CAP)
757 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758
759 if (level != SOL_BLUETOOTH)
760 return -ENOPROTOOPT;
761
762 lock_sock(sk);
763
764 switch (optname) {
765 case BT_SECURITY:
766 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
767 chan->chan_type != L2CAP_CHAN_FIXED &&
768 chan->chan_type != L2CAP_CHAN_RAW) {
769 err = -EINVAL;
770 break;
771 }
772
773 sec.level = BT_SECURITY_LOW;
774
775 len = min_t(unsigned int, sizeof(sec), optlen);
776 if (copy_from_user((char *) &sec, optval, len)) {
777 err = -EFAULT;
778 break;
779 }
780
781 if (sec.level < BT_SECURITY_LOW ||
782 sec.level > BT_SECURITY_FIPS) {
783 err = -EINVAL;
784 break;
785 }
786
787 chan->sec_level = sec.level;
788
789 if (!chan->conn)
790 break;
791
792 conn = chan->conn;
793
794 /* change security for LE channels */
795 if (chan->scid == L2CAP_CID_ATT) {
796 if (smp_conn_security(conn->hcon, sec.level)) {
797 err = -EINVAL;
798 break;
799 }
800
801 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
802 sk->sk_state = BT_CONFIG;
803 chan->state = BT_CONFIG;
804
805 /* or for ACL link */
806 } else if ((sk->sk_state == BT_CONNECT2 &&
807 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
808 sk->sk_state == BT_CONNECTED) {
809 if (!l2cap_chan_check_security(chan, true))
810 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
811 else
812 sk->sk_state_change(sk);
813 } else {
814 err = -EINVAL;
815 }
816 break;
817
818 case BT_DEFER_SETUP:
819 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
820 err = -EINVAL;
821 break;
822 }
823
824 if (get_user(opt, (u32 __user *) optval)) {
825 err = -EFAULT;
826 break;
827 }
828
829 if (opt) {
830 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
831 set_bit(FLAG_DEFER_SETUP, &chan->flags);
832 } else {
833 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
834 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
835 }
836 break;
837
838 case BT_FLUSHABLE:
839 if (get_user(opt, (u32 __user *) optval)) {
840 err = -EFAULT;
841 break;
842 }
843
844 if (opt > BT_FLUSHABLE_ON) {
845 err = -EINVAL;
846 break;
847 }
848
849 if (opt == BT_FLUSHABLE_OFF) {
850 conn = chan->conn;
851 /* proceed further only when we have l2cap_conn and
852 No Flush support in the LM */
853 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
854 err = -EINVAL;
855 break;
856 }
857 }
858
859 if (opt)
860 set_bit(FLAG_FLUSHABLE, &chan->flags);
861 else
862 clear_bit(FLAG_FLUSHABLE, &chan->flags);
863 break;
864
865 case BT_POWER:
866 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
867 chan->chan_type != L2CAP_CHAN_RAW) {
868 err = -EINVAL;
869 break;
870 }
871
872 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
873
874 len = min_t(unsigned int, sizeof(pwr), optlen);
875 if (copy_from_user((char *) &pwr, optval, len)) {
876 err = -EFAULT;
877 break;
878 }
879
880 if (pwr.force_active)
881 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
882 else
883 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
884 break;
885
886 case BT_CHANNEL_POLICY:
887 if (get_user(opt, (u32 __user *) optval)) {
888 err = -EFAULT;
889 break;
890 }
891
892 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
893 err = -EINVAL;
894 break;
895 }
896
897 if (chan->mode != L2CAP_MODE_ERTM &&
898 chan->mode != L2CAP_MODE_STREAMING) {
899 err = -EOPNOTSUPP;
900 break;
901 }
902
903 chan->chan_policy = (u8) opt;
904
905 if (sk->sk_state == BT_CONNECTED &&
906 chan->move_role == L2CAP_MOVE_ROLE_NONE)
907 l2cap_move_start(chan);
908
909 break;
910
911 case BT_SNDMTU:
912 if (!bdaddr_type_is_le(chan->src_type)) {
913 err = -EINVAL;
914 break;
915 }
916
917 /* Setting is not supported as it's the remote side that
918 * decides this.
919 */
920 err = -EPERM;
921 break;
922
923 case BT_RCVMTU:
924 if (!bdaddr_type_is_le(chan->src_type)) {
925 err = -EINVAL;
926 break;
927 }
928
929 if (sk->sk_state == BT_CONNECTED) {
930 err = -EISCONN;
931 break;
932 }
933
934 if (get_user(opt, (u16 __user *) optval)) {
935 err = -EFAULT;
936 break;
937 }
938
939 chan->imtu = opt;
940 break;
941
942 default:
943 err = -ENOPROTOOPT;
944 break;
945 }
946
947 release_sock(sk);
948 return err;
949}
950
951static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
952 size_t len)
953{
954 struct sock *sk = sock->sk;
955 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
956 int err;
957
958 BT_DBG("sock %p, sk %p", sock, sk);
959
960 err = sock_error(sk);
961 if (err)
962 return err;
963
964 if (msg->msg_flags & MSG_OOB)
965 return -EOPNOTSUPP;
966
967 if (sk->sk_state != BT_CONNECTED)
968 return -ENOTCONN;
969
970 lock_sock(sk);
971 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 release_sock(sk);
973 if (err)
974 return err;
975
976 l2cap_chan_lock(chan);
977 err = l2cap_chan_send(chan, msg, len);
978 l2cap_chan_unlock(chan);
979
980 return err;
981}
982
983static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
984 size_t len, int flags)
985{
986 struct sock *sk = sock->sk;
987 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 int err;
989
990 lock_sock(sk);
991
992 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
993 &bt_sk(sk)->flags)) {
994 if (bdaddr_type_is_le(pi->chan->src_type)) {
995 sk->sk_state = BT_CONNECTED;
996 pi->chan->state = BT_CONNECTED;
997 __l2cap_le_connect_rsp_defer(pi->chan);
998 } else {
999 sk->sk_state = BT_CONFIG;
1000 pi->chan->state = BT_CONFIG;
1001 __l2cap_connect_rsp_defer(pi->chan);
1002 }
1003
1004 err = 0;
1005 goto done;
1006 }
1007
1008 release_sock(sk);
1009
1010 if (sock->type == SOCK_STREAM)
1011 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1012 else
1013 err = bt_sock_recvmsg(sock, msg, len, flags);
1014
1015 if (pi->chan->mode != L2CAP_MODE_ERTM)
1016 return err;
1017
1018 /* Attempt to put pending rx data in the socket buffer */
1019
1020 lock_sock(sk);
1021
1022 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1023 goto done;
1024
1025 if (pi->rx_busy_skb) {
1026 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1027 pi->rx_busy_skb = NULL;
1028 else
1029 goto done;
1030 }
1031
1032 /* Restore data flow when half of the receive buffer is
1033 * available. This avoids resending large numbers of
1034 * frames.
1035 */
1036 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1037 l2cap_chan_busy(pi->chan, 0);
1038
1039done:
1040 release_sock(sk);
1041 return err;
1042}
1043
1044/* Kill socket (only if zapped and orphan)
1045 * Must be called on unlocked socket.
1046 */
1047static void l2cap_sock_kill(struct sock *sk)
1048{
1049 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1050 return;
1051
1052 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1053
1054 /* Kill poor orphan */
1055
1056 l2cap_chan_put(l2cap_pi(sk)->chan);
1057 sock_set_flag(sk, SOCK_DEAD);
1058 sock_put(sk);
1059}
1060
1061static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1062{
1063 DECLARE_WAITQUEUE(wait, current);
1064 int err = 0;
1065 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1066 /* Timeout to prevent infinite loop */
1067 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1068
1069 add_wait_queue(sk_sleep(sk), &wait);
1070 set_current_state(TASK_INTERRUPTIBLE);
1071 do {
1072 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1073 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1074 jiffies_to_msecs(timeout - jiffies));
1075
1076 if (!timeo)
1077 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1078
1079 if (signal_pending(current)) {
1080 err = sock_intr_errno(timeo);
1081 break;
1082 }
1083
1084 release_sock(sk);
1085 timeo = schedule_timeout(timeo);
1086 lock_sock(sk);
1087 set_current_state(TASK_INTERRUPTIBLE);
1088
1089 err = sock_error(sk);
1090 if (err)
1091 break;
1092
1093 if (time_after(jiffies, timeout)) {
1094 err = -ENOLINK;
1095 break;
1096 }
1097
1098 } while (chan->unacked_frames > 0 &&
1099 chan->state == BT_CONNECTED);
1100
1101 set_current_state(TASK_RUNNING);
1102 remove_wait_queue(sk_sleep(sk), &wait);
1103 return err;
1104}
1105
1106static int l2cap_sock_shutdown(struct socket *sock, int how)
1107{
1108 struct sock *sk = sock->sk;
1109 struct l2cap_chan *chan;
1110 struct l2cap_conn *conn;
1111 int err = 0;
1112
1113 BT_DBG("sock %p, sk %p", sock, sk);
1114
1115 if (!sk)
1116 return 0;
1117
1118 lock_sock(sk);
1119
1120 if (sk->sk_shutdown)
1121 goto shutdown_already;
1122
1123 BT_DBG("Handling sock shutdown");
1124
1125 /* prevent sk structure from being freed whilst unlocked */
1126 sock_hold(sk);
1127
1128 chan = l2cap_pi(sk)->chan;
1129 /* prevent chan structure from being freed whilst unlocked */
1130 l2cap_chan_hold(chan);
1131
1132 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1133
1134 if (chan->mode == L2CAP_MODE_ERTM &&
1135 chan->unacked_frames > 0 &&
1136 chan->state == BT_CONNECTED) {
1137 err = __l2cap_wait_ack(sk, chan);
1138
1139 /* After waiting for ACKs, check whether shutdown
1140 * has already been actioned to close the L2CAP
1141 * link such as by l2cap_disconnection_req().
1142 */
1143 if (sk->sk_shutdown)
1144 goto has_shutdown;
1145 }
1146
1147 sk->sk_shutdown = SHUTDOWN_MASK;
1148 release_sock(sk);
1149
1150 l2cap_chan_lock(chan);
1151 conn = chan->conn;
1152 if (conn)
1153 /* prevent conn structure from being freed */
1154 l2cap_conn_get(conn);
1155 l2cap_chan_unlock(chan);
1156
1157 if (conn)
1158 /* mutex lock must be taken before l2cap_chan_lock() */
1159 mutex_lock(&conn->chan_lock);
1160
1161 l2cap_chan_lock(chan);
1162 l2cap_chan_close(chan, 0);
1163 l2cap_chan_unlock(chan);
1164
1165 if (conn) {
1166 mutex_unlock(&conn->chan_lock);
1167 l2cap_conn_put(conn);
1168 }
1169
1170 lock_sock(sk);
1171
1172 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1173 !(current->flags & PF_EXITING))
1174 err = bt_sock_wait_state(sk, BT_CLOSED,
1175 sk->sk_lingertime);
1176
1177has_shutdown:
1178 l2cap_chan_put(chan);
1179 sock_put(sk);
1180
1181shutdown_already:
1182 if (!err && sk->sk_err)
1183 err = -sk->sk_err;
1184
1185 release_sock(sk);
1186
1187 BT_DBG("Sock shutdown complete err: %d", err);
1188
1189 return err;
1190}
1191
1192static int l2cap_sock_release(struct socket *sock)
1193{
1194 struct sock *sk = sock->sk;
1195 int err;
1196
1197 BT_DBG("sock %p, sk %p", sock, sk);
1198
1199 if (!sk)
1200 return 0;
1201
1202 bt_sock_unlink(&l2cap_sk_list, sk);
1203
1204 err = l2cap_sock_shutdown(sock, 2);
1205
1206 sock_orphan(sk);
1207 l2cap_sock_kill(sk);
1208 return err;
1209}
1210
1211static void l2cap_sock_cleanup_listen(struct sock *parent)
1212{
1213 struct sock *sk;
1214
1215 BT_DBG("parent %p state %s", parent,
1216 state_to_string(parent->sk_state));
1217
1218 /* Close not yet accepted channels */
1219 while ((sk = bt_accept_dequeue(parent, NULL))) {
1220 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1221
1222 BT_DBG("child chan %p state %s", chan,
1223 state_to_string(chan->state));
1224
1225 l2cap_chan_lock(chan);
1226 __clear_chan_timer(chan);
1227 l2cap_chan_close(chan, ECONNRESET);
1228 l2cap_chan_unlock(chan);
1229
1230 l2cap_sock_kill(sk);
1231 }
1232}
1233
1234static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1235{
1236 struct sock *sk, *parent = chan->data;
1237
1238 lock_sock(parent);
1239
1240 /* Check for backlog size */
1241 if (sk_acceptq_is_full(parent)) {
1242 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1243 release_sock(parent);
1244 return NULL;
1245 }
1246
1247 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1248 GFP_ATOMIC, 0);
1249 if (!sk) {
1250 release_sock(parent);
1251 return NULL;
1252 }
1253
1254 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1255
1256 l2cap_sock_init(sk, parent);
1257
1258 bt_accept_enqueue(parent, sk, false);
1259
1260 release_sock(parent);
1261
1262 return l2cap_pi(sk)->chan;
1263}
1264
1265static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1266{
1267 struct sock *sk = chan->data;
1268 int err;
1269
1270 lock_sock(sk);
1271
1272 if (l2cap_pi(sk)->rx_busy_skb) {
1273 err = -ENOMEM;
1274 goto done;
1275 }
1276
1277 if (chan->mode != L2CAP_MODE_ERTM &&
1278 chan->mode != L2CAP_MODE_STREAMING) {
1279 /* Even if no filter is attached, we could potentially
1280 * get errors from security modules, etc.
1281 */
1282 err = sk_filter(sk, skb);
1283 if (err)
1284 goto done;
1285 }
1286
1287 err = __sock_queue_rcv_skb(sk, skb);
1288
1289 /* For ERTM, handle one skb that doesn't fit into the recv
1290 * buffer. This is important to do because the data frames
1291 * have already been acked, so the skb cannot be discarded.
1292 *
1293 * Notify the l2cap core that the buffer is full, so the
1294 * LOCAL_BUSY state is entered and no more frames are
1295 * acked and reassembled until there is buffer space
1296 * available.
1297 */
1298 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1299 l2cap_pi(sk)->rx_busy_skb = skb;
1300 l2cap_chan_busy(chan, 1);
1301 err = 0;
1302 }
1303
1304done:
1305 release_sock(sk);
1306
1307 return err;
1308}
1309
1310static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1311{
1312 struct sock *sk = chan->data;
1313
1314 l2cap_sock_kill(sk);
1315}
1316
1317static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1318{
1319 struct sock *sk = chan->data;
1320 struct sock *parent;
1321
1322 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1323
1324 /* This callback can be called both for server (BT_LISTEN)
1325 * sockets as well as "normal" ones. To avoid lockdep warnings
1326 * with child socket locking (through l2cap_sock_cleanup_listen)
1327 * we need separation into separate nesting levels. The simplest
1328 * way to accomplish this is to inherit the nesting level used
1329 * for the channel.
1330 */
1331 lock_sock_nested(sk, atomic_read(&chan->nesting));
1332
1333 parent = bt_sk(sk)->parent;
1334
1335 sock_set_flag(sk, SOCK_ZAPPED);
1336
1337 switch (chan->state) {
1338 case BT_OPEN:
1339 case BT_BOUND:
1340 case BT_CLOSED:
1341 break;
1342 case BT_LISTEN:
1343 l2cap_sock_cleanup_listen(sk);
1344 sk->sk_state = BT_CLOSED;
1345 chan->state = BT_CLOSED;
1346
1347 break;
1348 default:
1349 sk->sk_state = BT_CLOSED;
1350 chan->state = BT_CLOSED;
1351
1352 sk->sk_err = err;
1353
1354 if (parent) {
1355 bt_accept_unlink(sk);
1356 parent->sk_data_ready(parent);
1357 } else {
1358 sk->sk_state_change(sk);
1359 }
1360
1361 break;
1362 }
1363
1364 release_sock(sk);
1365}
1366
1367static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1368 int err)
1369{
1370 struct sock *sk = chan->data;
1371
1372 sk->sk_state = state;
1373
1374 if (err)
1375 sk->sk_err = err;
1376}
1377
1378static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1379 unsigned long hdr_len,
1380 unsigned long len, int nb)
1381{
1382 struct sock *sk = chan->data;
1383 struct sk_buff *skb;
1384 int err;
1385
1386 l2cap_chan_unlock(chan);
1387 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1388 l2cap_chan_lock(chan);
1389
1390 if (!skb)
1391 return ERR_PTR(err);
1392
1393 skb->priority = sk->sk_priority;
1394
1395 bt_cb(skb)->l2cap.chan = chan;
1396
1397 return skb;
1398}
1399
1400static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1401{
1402 struct sock *sk = chan->data;
1403 struct sock *parent;
1404
1405 lock_sock(sk);
1406
1407 parent = bt_sk(sk)->parent;
1408
1409 BT_DBG("sk %p, parent %p", sk, parent);
1410
1411 sk->sk_state = BT_CONNECTED;
1412 sk->sk_state_change(sk);
1413
1414 if (parent)
1415 parent->sk_data_ready(parent);
1416
1417 release_sock(sk);
1418}
1419
1420static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1421{
1422 struct sock *parent, *sk = chan->data;
1423
1424 lock_sock(sk);
1425
1426 parent = bt_sk(sk)->parent;
1427 if (parent)
1428 parent->sk_data_ready(parent);
1429
1430 release_sock(sk);
1431}
1432
1433static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1434{
1435 struct sock *sk = chan->data;
1436
1437 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1438 sk->sk_state = BT_CONNECTED;
1439 chan->state = BT_CONNECTED;
1440 }
1441
1442 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1443 sk->sk_state_change(sk);
1444}
1445
1446static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1447{
1448 struct sock *sk = chan->data;
1449
1450 lock_sock(sk);
1451 sk->sk_shutdown = SHUTDOWN_MASK;
1452 release_sock(sk);
1453}
1454
1455static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1456{
1457 struct sock *sk = chan->data;
1458
1459 return sk->sk_sndtimeo;
1460}
1461
1462static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1463{
1464 struct sock *sk = chan->data;
1465
1466 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1467 sk->sk_state_change(sk);
1468}
1469
1470static const struct l2cap_ops l2cap_chan_ops = {
1471 .name = "L2CAP Socket Interface",
1472 .new_connection = l2cap_sock_new_connection_cb,
1473 .recv = l2cap_sock_recv_cb,
1474 .close = l2cap_sock_close_cb,
1475 .teardown = l2cap_sock_teardown_cb,
1476 .state_change = l2cap_sock_state_change_cb,
1477 .ready = l2cap_sock_ready_cb,
1478 .defer = l2cap_sock_defer_cb,
1479 .resume = l2cap_sock_resume_cb,
1480 .suspend = l2cap_sock_suspend_cb,
1481 .set_shutdown = l2cap_sock_set_shutdown_cb,
1482 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1483 .alloc_skb = l2cap_sock_alloc_skb_cb,
1484};
1485
1486static void l2cap_sock_destruct(struct sock *sk)
1487{
1488 BT_DBG("sk %p", sk);
1489
1490 if (l2cap_pi(sk)->chan)
1491 l2cap_chan_put(l2cap_pi(sk)->chan);
1492
1493 if (l2cap_pi(sk)->rx_busy_skb) {
1494 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1495 l2cap_pi(sk)->rx_busy_skb = NULL;
1496 }
1497
1498 skb_queue_purge(&sk->sk_receive_queue);
1499 skb_queue_purge(&sk->sk_write_queue);
1500}
1501
1502static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1503 int *msg_namelen)
1504{
1505 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1506
1507 memset(la, 0, sizeof(struct sockaddr_l2));
1508 la->l2_family = AF_BLUETOOTH;
1509 la->l2_psm = bt_cb(skb)->l2cap.psm;
1510 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1511
1512 *msg_namelen = sizeof(struct sockaddr_l2);
1513}
1514
1515static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1516{
1517 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1518
1519 BT_DBG("sk %p", sk);
1520
1521 if (parent) {
1522 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1523
1524 sk->sk_type = parent->sk_type;
1525 bt_sk(sk)->flags = bt_sk(parent)->flags;
1526
1527 chan->chan_type = pchan->chan_type;
1528 chan->imtu = pchan->imtu;
1529 chan->omtu = pchan->omtu;
1530 chan->conf_state = pchan->conf_state;
1531 chan->mode = pchan->mode;
1532 chan->fcs = pchan->fcs;
1533 chan->max_tx = pchan->max_tx;
1534 chan->tx_win = pchan->tx_win;
1535 chan->tx_win_max = pchan->tx_win_max;
1536 chan->sec_level = pchan->sec_level;
1537 chan->flags = pchan->flags;
1538 chan->tx_credits = pchan->tx_credits;
1539 chan->rx_credits = pchan->rx_credits;
1540
1541 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1542 chan->scid = pchan->scid;
1543 chan->dcid = pchan->scid;
1544 }
1545
1546 security_sk_clone(parent, sk);
1547 } else {
1548 switch (sk->sk_type) {
1549 case SOCK_RAW:
1550 chan->chan_type = L2CAP_CHAN_RAW;
1551 break;
1552 case SOCK_DGRAM:
1553 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1554 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1555 break;
1556 case SOCK_SEQPACKET:
1557 case SOCK_STREAM:
1558 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1559 break;
1560 }
1561
1562 chan->imtu = L2CAP_DEFAULT_MTU;
1563 chan->omtu = 0;
1564 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1565 chan->mode = L2CAP_MODE_ERTM;
1566 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1567 } else {
1568 chan->mode = L2CAP_MODE_BASIC;
1569 }
1570
1571 l2cap_chan_set_defaults(chan);
1572 }
1573
1574 /* Default config options */
1575 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1576
1577 chan->data = sk;
1578 chan->ops = &l2cap_chan_ops;
1579}
1580
1581static struct proto l2cap_proto = {
1582 .name = "L2CAP",
1583 .owner = THIS_MODULE,
1584 .obj_size = sizeof(struct l2cap_pinfo)
1585};
1586
1587static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1588 int proto, gfp_t prio, int kern)
1589{
1590 struct sock *sk;
1591 struct l2cap_chan *chan;
1592
1593 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1594 if (!sk)
1595 return NULL;
1596
1597 sock_init_data(sock, sk);
1598 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1599
1600 sk->sk_destruct = l2cap_sock_destruct;
1601 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1602
1603 sock_reset_flag(sk, SOCK_ZAPPED);
1604
1605 sk->sk_protocol = proto;
1606 sk->sk_state = BT_OPEN;
1607
1608 chan = l2cap_chan_create();
1609 if (!chan) {
1610 sk_free(sk);
1611 return NULL;
1612 }
1613
1614 l2cap_chan_hold(chan);
1615
1616 l2cap_pi(sk)->chan = chan;
1617
1618 return sk;
1619}
1620
1621static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1622 int kern)
1623{
1624 struct sock *sk;
1625
1626 BT_DBG("sock %p", sock);
1627
1628 sock->state = SS_UNCONNECTED;
1629
1630 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1631 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1632 return -ESOCKTNOSUPPORT;
1633
1634 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1635 return -EPERM;
1636
1637 sock->ops = &l2cap_sock_ops;
1638
1639 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1640 if (!sk)
1641 return -ENOMEM;
1642
1643 l2cap_sock_init(sk, NULL);
1644 bt_sock_link(&l2cap_sk_list, sk);
1645 return 0;
1646}
1647
1648static const struct proto_ops l2cap_sock_ops = {
1649 .family = PF_BLUETOOTH,
1650 .owner = THIS_MODULE,
1651 .release = l2cap_sock_release,
1652 .bind = l2cap_sock_bind,
1653 .connect = l2cap_sock_connect,
1654 .listen = l2cap_sock_listen,
1655 .accept = l2cap_sock_accept,
1656 .getname = l2cap_sock_getname,
1657 .sendmsg = l2cap_sock_sendmsg,
1658 .recvmsg = l2cap_sock_recvmsg,
1659 .poll = bt_sock_poll,
1660 .ioctl = bt_sock_ioctl,
1661 .gettstamp = sock_gettstamp,
1662 .mmap = sock_no_mmap,
1663 .socketpair = sock_no_socketpair,
1664 .shutdown = l2cap_sock_shutdown,
1665 .setsockopt = l2cap_sock_setsockopt,
1666 .getsockopt = l2cap_sock_getsockopt
1667};
1668
1669static const struct net_proto_family l2cap_sock_family_ops = {
1670 .family = PF_BLUETOOTH,
1671 .owner = THIS_MODULE,
1672 .create = l2cap_sock_create,
1673};
1674
1675int __init l2cap_init_sockets(void)
1676{
1677 int err;
1678
1679 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1680
1681 err = proto_register(&l2cap_proto, 0);
1682 if (err < 0)
1683 return err;
1684
1685 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1686 if (err < 0) {
1687 BT_ERR("L2CAP socket registration failed");
1688 goto error;
1689 }
1690
1691 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1692 NULL);
1693 if (err < 0) {
1694 BT_ERR("Failed to create L2CAP proc file");
1695 bt_sock_unregister(BTPROTO_L2CAP);
1696 goto error;
1697 }
1698
1699 BT_INFO("L2CAP socket layer initialized");
1700
1701 return 0;
1702
1703error:
1704 proto_unregister(&l2cap_proto);
1705 return err;
1706}
1707
1708void l2cap_cleanup_sockets(void)
1709{
1710 bt_procfs_cleanup(&init_net, "l2cap");
1711 bt_sock_unregister(BTPROTO_L2CAP);
1712 proto_unregister(&l2cap_proto);
1713}
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6
7 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License version 2 as
11 published by the Free Software Foundation;
12
13 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
17 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
18 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21
22 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
23 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
24 SOFTWARE IS DISCLAIMED.
25*/
26
27/* Bluetooth L2CAP sockets. */
28
29#include <linux/security.h>
30
31#include <net/bluetooth/bluetooth.h>
32#include <net/bluetooth/hci_core.h>
33#include <net/bluetooth/l2cap.h>
34#include <net/bluetooth/smp.h>
35
36static const struct proto_ops l2cap_sock_ops;
37static void l2cap_sock_init(struct sock *sk, struct sock *parent);
38static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
39
40static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
41{
42 struct sock *sk = sock->sk;
43 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
44 struct sockaddr_l2 la;
45 int len, err = 0;
46
47 BT_DBG("sk %p", sk);
48
49 if (!addr || addr->sa_family != AF_BLUETOOTH)
50 return -EINVAL;
51
52 memset(&la, 0, sizeof(la));
53 len = min_t(unsigned int, sizeof(la), alen);
54 memcpy(&la, addr, len);
55
56 if (la.l2_cid && la.l2_psm)
57 return -EINVAL;
58
59 lock_sock(sk);
60
61 if (sk->sk_state != BT_OPEN) {
62 err = -EBADFD;
63 goto done;
64 }
65
66 if (la.l2_psm) {
67 __u16 psm = __le16_to_cpu(la.l2_psm);
68
69 /* PSM must be odd and lsb of upper byte must be 0 */
70 if ((psm & 0x0101) != 0x0001) {
71 err = -EINVAL;
72 goto done;
73 }
74
75 /* Restrict usage of well-known PSMs */
76 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
77 err = -EACCES;
78 goto done;
79 }
80 }
81
82 if (la.l2_cid)
83 err = l2cap_add_scid(chan, la.l2_cid);
84 else
85 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
86
87 if (err < 0)
88 goto done;
89
90 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
91 __le16_to_cpu(la.l2_psm) == 0x0003)
92 chan->sec_level = BT_SECURITY_SDP;
93
94 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
95
96 chan->state = BT_BOUND;
97 sk->sk_state = BT_BOUND;
98
99done:
100 release_sock(sk);
101 return err;
102}
103
104static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
105{
106 struct sock *sk = sock->sk;
107 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
108 struct sockaddr_l2 la;
109 int len, err = 0;
110
111 BT_DBG("sk %p", sk);
112
113 if (!addr || alen < sizeof(addr->sa_family) ||
114 addr->sa_family != AF_BLUETOOTH)
115 return -EINVAL;
116
117 memset(&la, 0, sizeof(la));
118 len = min_t(unsigned int, sizeof(la), alen);
119 memcpy(&la, addr, len);
120
121 if (la.l2_cid && la.l2_psm)
122 return -EINVAL;
123
124 lock_sock(sk);
125
126 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED
127 && !(la.l2_psm || la.l2_cid)) {
128 err = -EINVAL;
129 goto done;
130 }
131
132 switch (chan->mode) {
133 case L2CAP_MODE_BASIC:
134 break;
135 case L2CAP_MODE_ERTM:
136 case L2CAP_MODE_STREAMING:
137 if (!disable_ertm)
138 break;
139 /* fall through */
140 default:
141 err = -ENOTSUPP;
142 goto done;
143 }
144
145 switch (sk->sk_state) {
146 case BT_CONNECT:
147 case BT_CONNECT2:
148 case BT_CONFIG:
149 /* Already connecting */
150 goto wait;
151
152 case BT_CONNECTED:
153 /* Already connected */
154 err = -EISCONN;
155 goto done;
156
157 case BT_OPEN:
158 case BT_BOUND:
159 /* Can connect */
160 break;
161
162 default:
163 err = -EBADFD;
164 goto done;
165 }
166
167 /* PSM must be odd and lsb of upper byte must be 0 */
168 if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && !la.l2_cid &&
169 chan->chan_type != L2CAP_CHAN_RAW) {
170 err = -EINVAL;
171 goto done;
172 }
173
174 /* Set destination address and psm */
175 bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
176 chan->psm = la.l2_psm;
177 chan->dcid = la.l2_cid;
178
179 err = l2cap_chan_connect(l2cap_pi(sk)->chan);
180 if (err)
181 goto done;
182
183wait:
184 err = bt_sock_wait_state(sk, BT_CONNECTED,
185 sock_sndtimeo(sk, flags & O_NONBLOCK));
186done:
187 release_sock(sk);
188 return err;
189}
190
191static int l2cap_sock_listen(struct socket *sock, int backlog)
192{
193 struct sock *sk = sock->sk;
194 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
195 int err = 0;
196
197 BT_DBG("sk %p backlog %d", sk, backlog);
198
199 lock_sock(sk);
200
201 if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
202 || sk->sk_state != BT_BOUND) {
203 err = -EBADFD;
204 goto done;
205 }
206
207 switch (chan->mode) {
208 case L2CAP_MODE_BASIC:
209 break;
210 case L2CAP_MODE_ERTM:
211 case L2CAP_MODE_STREAMING:
212 if (!disable_ertm)
213 break;
214 /* fall through */
215 default:
216 err = -ENOTSUPP;
217 goto done;
218 }
219
220 sk->sk_max_ack_backlog = backlog;
221 sk->sk_ack_backlog = 0;
222
223 chan->state = BT_LISTEN;
224 sk->sk_state = BT_LISTEN;
225
226done:
227 release_sock(sk);
228 return err;
229}
230
231static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
232{
233 DECLARE_WAITQUEUE(wait, current);
234 struct sock *sk = sock->sk, *nsk;
235 long timeo;
236 int err = 0;
237
238 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
239
240 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
241
242 BT_DBG("sk %p timeo %ld", sk, timeo);
243
244 /* Wait for an incoming connection. (wake-one). */
245 add_wait_queue_exclusive(sk_sleep(sk), &wait);
246 while (1) {
247 set_current_state(TASK_INTERRUPTIBLE);
248
249 if (sk->sk_state != BT_LISTEN) {
250 err = -EBADFD;
251 break;
252 }
253
254 nsk = bt_accept_dequeue(sk, newsock);
255 if (nsk)
256 break;
257
258 if (!timeo) {
259 err = -EAGAIN;
260 break;
261 }
262
263 if (signal_pending(current)) {
264 err = sock_intr_errno(timeo);
265 break;
266 }
267
268 release_sock(sk);
269 timeo = schedule_timeout(timeo);
270 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
271 }
272 __set_current_state(TASK_RUNNING);
273 remove_wait_queue(sk_sleep(sk), &wait);
274
275 if (err)
276 goto done;
277
278 newsock->state = SS_CONNECTED;
279
280 BT_DBG("new socket %p", nsk);
281
282done:
283 release_sock(sk);
284 return err;
285}
286
287static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
288{
289 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
290 struct sock *sk = sock->sk;
291 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
292
293 BT_DBG("sock %p, sk %p", sock, sk);
294
295 addr->sa_family = AF_BLUETOOTH;
296 *len = sizeof(struct sockaddr_l2);
297
298 if (peer) {
299 la->l2_psm = chan->psm;
300 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
301 la->l2_cid = cpu_to_le16(chan->dcid);
302 } else {
303 la->l2_psm = chan->sport;
304 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
305 la->l2_cid = cpu_to_le16(chan->scid);
306 }
307
308 return 0;
309}
310
311static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
312{
313 struct sock *sk = sock->sk;
314 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
315 struct l2cap_options opts;
316 struct l2cap_conninfo cinfo;
317 int len, err = 0;
318 u32 opt;
319
320 BT_DBG("sk %p", sk);
321
322 if (get_user(len, optlen))
323 return -EFAULT;
324
325 lock_sock(sk);
326
327 switch (optname) {
328 case L2CAP_OPTIONS:
329 memset(&opts, 0, sizeof(opts));
330 opts.imtu = chan->imtu;
331 opts.omtu = chan->omtu;
332 opts.flush_to = chan->flush_to;
333 opts.mode = chan->mode;
334 opts.fcs = chan->fcs;
335 opts.max_tx = chan->max_tx;
336 opts.txwin_size = (__u16)chan->tx_win;
337
338 len = min_t(unsigned int, len, sizeof(opts));
339 if (copy_to_user(optval, (char *) &opts, len))
340 err = -EFAULT;
341
342 break;
343
344 case L2CAP_LM:
345 switch (chan->sec_level) {
346 case BT_SECURITY_LOW:
347 opt = L2CAP_LM_AUTH;
348 break;
349 case BT_SECURITY_MEDIUM:
350 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
351 break;
352 case BT_SECURITY_HIGH:
353 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
354 L2CAP_LM_SECURE;
355 break;
356 default:
357 opt = 0;
358 break;
359 }
360
361 if (chan->role_switch)
362 opt |= L2CAP_LM_MASTER;
363
364 if (chan->force_reliable)
365 opt |= L2CAP_LM_RELIABLE;
366
367 if (put_user(opt, (u32 __user *) optval))
368 err = -EFAULT;
369 break;
370
371 case L2CAP_CONNINFO:
372 if (sk->sk_state != BT_CONNECTED &&
373 !(sk->sk_state == BT_CONNECT2 &&
374 bt_sk(sk)->defer_setup)) {
375 err = -ENOTCONN;
376 break;
377 }
378
379 memset(&cinfo, 0, sizeof(cinfo));
380 cinfo.hci_handle = chan->conn->hcon->handle;
381 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
382
383 len = min_t(unsigned int, len, sizeof(cinfo));
384 if (copy_to_user(optval, (char *) &cinfo, len))
385 err = -EFAULT;
386
387 break;
388
389 default:
390 err = -ENOPROTOOPT;
391 break;
392 }
393
394 release_sock(sk);
395 return err;
396}
397
398static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
399{
400 struct sock *sk = sock->sk;
401 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
402 struct bt_security sec;
403 struct bt_power pwr;
404 int len, err = 0;
405
406 BT_DBG("sk %p", sk);
407
408 if (level == SOL_L2CAP)
409 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
410
411 if (level != SOL_BLUETOOTH)
412 return -ENOPROTOOPT;
413
414 if (get_user(len, optlen))
415 return -EFAULT;
416
417 lock_sock(sk);
418
419 switch (optname) {
420 case BT_SECURITY:
421 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
422 chan->chan_type != L2CAP_CHAN_RAW) {
423 err = -EINVAL;
424 break;
425 }
426
427 memset(&sec, 0, sizeof(sec));
428 sec.level = chan->sec_level;
429
430 if (sk->sk_state == BT_CONNECTED)
431 sec.key_size = chan->conn->hcon->enc_key_size;
432
433 len = min_t(unsigned int, len, sizeof(sec));
434 if (copy_to_user(optval, (char *) &sec, len))
435 err = -EFAULT;
436
437 break;
438
439 case BT_DEFER_SETUP:
440 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
441 err = -EINVAL;
442 break;
443 }
444
445 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
446 err = -EFAULT;
447
448 break;
449
450 case BT_FLUSHABLE:
451 if (put_user(chan->flushable, (u32 __user *) optval))
452 err = -EFAULT;
453
454 break;
455
456 case BT_POWER:
457 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
458 && sk->sk_type != SOCK_RAW) {
459 err = -EINVAL;
460 break;
461 }
462
463 pwr.force_active = chan->force_active;
464
465 len = min_t(unsigned int, len, sizeof(pwr));
466 if (copy_to_user(optval, (char *) &pwr, len))
467 err = -EFAULT;
468
469 break;
470
471 default:
472 err = -ENOPROTOOPT;
473 break;
474 }
475
476 release_sock(sk);
477 return err;
478}
479
480static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
481{
482 struct sock *sk = sock->sk;
483 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
484 struct l2cap_options opts;
485 int len, err = 0;
486 u32 opt;
487
488 BT_DBG("sk %p", sk);
489
490 lock_sock(sk);
491
492 switch (optname) {
493 case L2CAP_OPTIONS:
494 if (sk->sk_state == BT_CONNECTED) {
495 err = -EINVAL;
496 break;
497 }
498
499 opts.imtu = chan->imtu;
500 opts.omtu = chan->omtu;
501 opts.flush_to = chan->flush_to;
502 opts.mode = chan->mode;
503 opts.fcs = chan->fcs;
504 opts.max_tx = chan->max_tx;
505 opts.txwin_size = (__u16)chan->tx_win;
506
507 len = min_t(unsigned int, sizeof(opts), optlen);
508 if (copy_from_user((char *) &opts, optval, len)) {
509 err = -EFAULT;
510 break;
511 }
512
513 if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
514 err = -EINVAL;
515 break;
516 }
517
518 chan->mode = opts.mode;
519 switch (chan->mode) {
520 case L2CAP_MODE_BASIC:
521 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
522 break;
523 case L2CAP_MODE_ERTM:
524 case L2CAP_MODE_STREAMING:
525 if (!disable_ertm)
526 break;
527 /* fall through */
528 default:
529 err = -EINVAL;
530 break;
531 }
532
533 chan->imtu = opts.imtu;
534 chan->omtu = opts.omtu;
535 chan->fcs = opts.fcs;
536 chan->max_tx = opts.max_tx;
537 chan->tx_win = (__u8)opts.txwin_size;
538 break;
539
540 case L2CAP_LM:
541 if (get_user(opt, (u32 __user *) optval)) {
542 err = -EFAULT;
543 break;
544 }
545
546 if (opt & L2CAP_LM_AUTH)
547 chan->sec_level = BT_SECURITY_LOW;
548 if (opt & L2CAP_LM_ENCRYPT)
549 chan->sec_level = BT_SECURITY_MEDIUM;
550 if (opt & L2CAP_LM_SECURE)
551 chan->sec_level = BT_SECURITY_HIGH;
552
553 chan->role_switch = (opt & L2CAP_LM_MASTER);
554 chan->force_reliable = (opt & L2CAP_LM_RELIABLE);
555 break;
556
557 default:
558 err = -ENOPROTOOPT;
559 break;
560 }
561
562 release_sock(sk);
563 return err;
564}
565
566static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
567{
568 struct sock *sk = sock->sk;
569 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
570 struct bt_security sec;
571 struct bt_power pwr;
572 struct l2cap_conn *conn;
573 int len, err = 0;
574 u32 opt;
575
576 BT_DBG("sk %p", sk);
577
578 if (level == SOL_L2CAP)
579 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
580
581 if (level != SOL_BLUETOOTH)
582 return -ENOPROTOOPT;
583
584 lock_sock(sk);
585
586 switch (optname) {
587 case BT_SECURITY:
588 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
589 chan->chan_type != L2CAP_CHAN_RAW) {
590 err = -EINVAL;
591 break;
592 }
593
594 sec.level = BT_SECURITY_LOW;
595
596 len = min_t(unsigned int, sizeof(sec), optlen);
597 if (copy_from_user((char *) &sec, optval, len)) {
598 err = -EFAULT;
599 break;
600 }
601
602 if (sec.level < BT_SECURITY_LOW ||
603 sec.level > BT_SECURITY_HIGH) {
604 err = -EINVAL;
605 break;
606 }
607
608 chan->sec_level = sec.level;
609
610 conn = chan->conn;
611 if (conn && chan->scid == L2CAP_CID_LE_DATA) {
612 if (!conn->hcon->out) {
613 err = -EINVAL;
614 break;
615 }
616
617 if (smp_conn_security(conn, sec.level))
618 break;
619
620 err = 0;
621 sk->sk_state = BT_CONFIG;
622 }
623 break;
624
625 case BT_DEFER_SETUP:
626 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
627 err = -EINVAL;
628 break;
629 }
630
631 if (get_user(opt, (u32 __user *) optval)) {
632 err = -EFAULT;
633 break;
634 }
635
636 bt_sk(sk)->defer_setup = opt;
637 break;
638
639 case BT_FLUSHABLE:
640 if (get_user(opt, (u32 __user *) optval)) {
641 err = -EFAULT;
642 break;
643 }
644
645 if (opt > BT_FLUSHABLE_ON) {
646 err = -EINVAL;
647 break;
648 }
649
650 if (opt == BT_FLUSHABLE_OFF) {
651 struct l2cap_conn *conn = chan->conn;
652 /* proceed further only when we have l2cap_conn and
653 No Flush support in the LM */
654 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
655 err = -EINVAL;
656 break;
657 }
658 }
659
660 chan->flushable = opt;
661 break;
662
663 case BT_POWER:
664 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
665 chan->chan_type != L2CAP_CHAN_RAW) {
666 err = -EINVAL;
667 break;
668 }
669
670 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
671
672 len = min_t(unsigned int, sizeof(pwr), optlen);
673 if (copy_from_user((char *) &pwr, optval, len)) {
674 err = -EFAULT;
675 break;
676 }
677 chan->force_active = pwr.force_active;
678 break;
679
680 default:
681 err = -ENOPROTOOPT;
682 break;
683 }
684
685 release_sock(sk);
686 return err;
687}
688
689static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
690{
691 struct sock *sk = sock->sk;
692 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
693 int err;
694
695 BT_DBG("sock %p, sk %p", sock, sk);
696
697 err = sock_error(sk);
698 if (err)
699 return err;
700
701 if (msg->msg_flags & MSG_OOB)
702 return -EOPNOTSUPP;
703
704 lock_sock(sk);
705
706 if (sk->sk_state != BT_CONNECTED) {
707 release_sock(sk);
708 return -ENOTCONN;
709 }
710
711 err = l2cap_chan_send(chan, msg, len);
712
713 release_sock(sk);
714 return err;
715}
716
717static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
718{
719 struct sock *sk = sock->sk;
720 struct l2cap_pinfo *pi = l2cap_pi(sk);
721 int err;
722
723 lock_sock(sk);
724
725 if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
726 sk->sk_state = BT_CONFIG;
727
728 __l2cap_connect_rsp_defer(pi->chan);
729 release_sock(sk);
730 return 0;
731 }
732
733 release_sock(sk);
734
735 if (sock->type == SOCK_STREAM)
736 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
737 else
738 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
739
740 if (pi->chan->mode != L2CAP_MODE_ERTM)
741 return err;
742
743 /* Attempt to put pending rx data in the socket buffer */
744
745 lock_sock(sk);
746
747 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
748 goto done;
749
750 if (pi->rx_busy_skb) {
751 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
752 pi->rx_busy_skb = NULL;
753 else
754 goto done;
755 }
756
757 /* Restore data flow when half of the receive buffer is
758 * available. This avoids resending large numbers of
759 * frames.
760 */
761 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
762 l2cap_chan_busy(pi->chan, 0);
763
764done:
765 release_sock(sk);
766 return err;
767}
768
769/* Kill socket (only if zapped and orphan)
770 * Must be called on unlocked socket.
771 */
772static void l2cap_sock_kill(struct sock *sk)
773{
774 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
775 return;
776
777 BT_DBG("sk %p state %d", sk, sk->sk_state);
778
779 /* Kill poor orphan */
780
781 l2cap_chan_destroy(l2cap_pi(sk)->chan);
782 sock_set_flag(sk, SOCK_DEAD);
783 sock_put(sk);
784}
785
786static int l2cap_sock_shutdown(struct socket *sock, int how)
787{
788 struct sock *sk = sock->sk;
789 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
790 int err = 0;
791
792 BT_DBG("sock %p, sk %p", sock, sk);
793
794 if (!sk)
795 return 0;
796
797 lock_sock(sk);
798 if (!sk->sk_shutdown) {
799 if (chan->mode == L2CAP_MODE_ERTM)
800 err = __l2cap_wait_ack(sk);
801
802 sk->sk_shutdown = SHUTDOWN_MASK;
803 l2cap_chan_close(chan, 0);
804
805 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
806 err = bt_sock_wait_state(sk, BT_CLOSED,
807 sk->sk_lingertime);
808 }
809
810 if (!err && sk->sk_err)
811 err = -sk->sk_err;
812
813 release_sock(sk);
814 return err;
815}
816
817static int l2cap_sock_release(struct socket *sock)
818{
819 struct sock *sk = sock->sk;
820 int err;
821
822 BT_DBG("sock %p, sk %p", sock, sk);
823
824 if (!sk)
825 return 0;
826
827 err = l2cap_sock_shutdown(sock, 2);
828
829 sock_orphan(sk);
830 l2cap_sock_kill(sk);
831 return err;
832}
833
834static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
835{
836 struct sock *sk, *parent = data;
837
838 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
839 GFP_ATOMIC);
840 if (!sk)
841 return NULL;
842
843 l2cap_sock_init(sk, parent);
844
845 return l2cap_pi(sk)->chan;
846}
847
848static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
849{
850 int err;
851 struct sock *sk = data;
852 struct l2cap_pinfo *pi = l2cap_pi(sk);
853
854 if (pi->rx_busy_skb)
855 return -ENOMEM;
856
857 err = sock_queue_rcv_skb(sk, skb);
858
859 /* For ERTM, handle one skb that doesn't fit into the recv
860 * buffer. This is important to do because the data frames
861 * have already been acked, so the skb cannot be discarded.
862 *
863 * Notify the l2cap core that the buffer is full, so the
864 * LOCAL_BUSY state is entered and no more frames are
865 * acked and reassembled until there is buffer space
866 * available.
867 */
868 if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
869 pi->rx_busy_skb = skb;
870 l2cap_chan_busy(pi->chan, 1);
871 err = 0;
872 }
873
874 return err;
875}
876
877static void l2cap_sock_close_cb(void *data)
878{
879 struct sock *sk = data;
880
881 l2cap_sock_kill(sk);
882}
883
884static void l2cap_sock_state_change_cb(void *data, int state)
885{
886 struct sock *sk = data;
887
888 sk->sk_state = state;
889}
890
891static struct l2cap_ops l2cap_chan_ops = {
892 .name = "L2CAP Socket Interface",
893 .new_connection = l2cap_sock_new_connection_cb,
894 .recv = l2cap_sock_recv_cb,
895 .close = l2cap_sock_close_cb,
896 .state_change = l2cap_sock_state_change_cb,
897};
898
899static void l2cap_sock_destruct(struct sock *sk)
900{
901 BT_DBG("sk %p", sk);
902
903 if (l2cap_pi(sk)->rx_busy_skb) {
904 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
905 l2cap_pi(sk)->rx_busy_skb = NULL;
906 }
907
908 skb_queue_purge(&sk->sk_receive_queue);
909 skb_queue_purge(&sk->sk_write_queue);
910}
911
912static void l2cap_sock_init(struct sock *sk, struct sock *parent)
913{
914 struct l2cap_pinfo *pi = l2cap_pi(sk);
915 struct l2cap_chan *chan = pi->chan;
916
917 BT_DBG("sk %p", sk);
918
919 if (parent) {
920 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
921
922 sk->sk_type = parent->sk_type;
923 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
924
925 chan->chan_type = pchan->chan_type;
926 chan->imtu = pchan->imtu;
927 chan->omtu = pchan->omtu;
928 chan->conf_state = pchan->conf_state;
929 chan->mode = pchan->mode;
930 chan->fcs = pchan->fcs;
931 chan->max_tx = pchan->max_tx;
932 chan->tx_win = pchan->tx_win;
933 chan->sec_level = pchan->sec_level;
934 chan->role_switch = pchan->role_switch;
935 chan->force_reliable = pchan->force_reliable;
936 chan->flushable = pchan->flushable;
937 chan->force_active = pchan->force_active;
938
939 security_sk_clone(parent, sk);
940 } else {
941
942 switch (sk->sk_type) {
943 case SOCK_RAW:
944 chan->chan_type = L2CAP_CHAN_RAW;
945 break;
946 case SOCK_DGRAM:
947 chan->chan_type = L2CAP_CHAN_CONN_LESS;
948 break;
949 case SOCK_SEQPACKET:
950 case SOCK_STREAM:
951 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
952 break;
953 }
954
955 chan->imtu = L2CAP_DEFAULT_MTU;
956 chan->omtu = 0;
957 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
958 chan->mode = L2CAP_MODE_ERTM;
959 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
960 } else {
961 chan->mode = L2CAP_MODE_BASIC;
962 }
963 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
964 chan->fcs = L2CAP_FCS_CRC16;
965 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
966 chan->sec_level = BT_SECURITY_LOW;
967 chan->role_switch = 0;
968 chan->force_reliable = 0;
969 chan->flushable = BT_FLUSHABLE_OFF;
970 chan->force_active = BT_POWER_FORCE_ACTIVE_ON;
971
972 }
973
974 /* Default config options */
975 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
976
977 chan->data = sk;
978 chan->ops = &l2cap_chan_ops;
979}
980
981static struct proto l2cap_proto = {
982 .name = "L2CAP",
983 .owner = THIS_MODULE,
984 .obj_size = sizeof(struct l2cap_pinfo)
985};
986
987static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
988{
989 struct sock *sk;
990 struct l2cap_chan *chan;
991
992 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
993 if (!sk)
994 return NULL;
995
996 sock_init_data(sock, sk);
997 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
998
999 sk->sk_destruct = l2cap_sock_destruct;
1000 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1001
1002 sock_reset_flag(sk, SOCK_ZAPPED);
1003
1004 sk->sk_protocol = proto;
1005 sk->sk_state = BT_OPEN;
1006
1007 chan = l2cap_chan_create(sk);
1008 if (!chan) {
1009 l2cap_sock_kill(sk);
1010 return NULL;
1011 }
1012
1013 l2cap_pi(sk)->chan = chan;
1014
1015 return sk;
1016}
1017
1018static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1019 int kern)
1020{
1021 struct sock *sk;
1022
1023 BT_DBG("sock %p", sock);
1024
1025 sock->state = SS_UNCONNECTED;
1026
1027 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1028 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1029 return -ESOCKTNOSUPPORT;
1030
1031 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1032 return -EPERM;
1033
1034 sock->ops = &l2cap_sock_ops;
1035
1036 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1037 if (!sk)
1038 return -ENOMEM;
1039
1040 l2cap_sock_init(sk, NULL);
1041 return 0;
1042}
1043
1044static const struct proto_ops l2cap_sock_ops = {
1045 .family = PF_BLUETOOTH,
1046 .owner = THIS_MODULE,
1047 .release = l2cap_sock_release,
1048 .bind = l2cap_sock_bind,
1049 .connect = l2cap_sock_connect,
1050 .listen = l2cap_sock_listen,
1051 .accept = l2cap_sock_accept,
1052 .getname = l2cap_sock_getname,
1053 .sendmsg = l2cap_sock_sendmsg,
1054 .recvmsg = l2cap_sock_recvmsg,
1055 .poll = bt_sock_poll,
1056 .ioctl = bt_sock_ioctl,
1057 .mmap = sock_no_mmap,
1058 .socketpair = sock_no_socketpair,
1059 .shutdown = l2cap_sock_shutdown,
1060 .setsockopt = l2cap_sock_setsockopt,
1061 .getsockopt = l2cap_sock_getsockopt
1062};
1063
1064static const struct net_proto_family l2cap_sock_family_ops = {
1065 .family = PF_BLUETOOTH,
1066 .owner = THIS_MODULE,
1067 .create = l2cap_sock_create,
1068};
1069
1070int __init l2cap_init_sockets(void)
1071{
1072 int err;
1073
1074 err = proto_register(&l2cap_proto, 0);
1075 if (err < 0)
1076 return err;
1077
1078 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1079 if (err < 0)
1080 goto error;
1081
1082 BT_INFO("L2CAP socket layer initialized");
1083
1084 return 0;
1085
1086error:
1087 BT_ERR("L2CAP socket registration failed");
1088 proto_unregister(&l2cap_proto);
1089 return err;
1090}
1091
1092void l2cap_cleanup_sockets(void)
1093{
1094 if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
1095 BT_ERR("L2CAP socket unregistration failed");
1096
1097 proto_unregister(&l2cap_proto);
1098}