1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5   Copyright (C) 2010 Google Inc.
   6   Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10   This program is free software; you can redistribute it and/or modify
  11   it under the terms of the GNU General Public License version 2 as
  12   published by the Free Software Foundation;
  13
  14   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25   SOFTWARE IS DISCLAIMED.
  26*/
  27
  28/* Bluetooth L2CAP sockets. */
  29
  30#include <linux/module.h>
  31#include <linux/export.h>
  32#include <linux/filter.h>
  33#include <linux/sched/signal.h>
  34
  35#include <net/bluetooth/bluetooth.h>
  36#include <net/bluetooth/hci_core.h>
  37#include <net/bluetooth/l2cap.h>
  38
  39#include "smp.h"
  40
  41static struct bt_sock_list l2cap_sk_list = {
  42	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43};
  44
  45static const struct proto_ops l2cap_sock_ops;
  46static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48				     int proto, gfp_t prio, int kern);
  49static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51bool l2cap_is_socket(struct socket *sock)
  52{
  53	return sock && sock->ops == &l2cap_sock_ops;
  54}
  55EXPORT_SYMBOL(l2cap_is_socket);
  56
  57static int l2cap_validate_bredr_psm(u16 psm)
  58{
  59	/* PSM must be odd and lsb of upper byte must be 0 */
  60	if ((psm & 0x0101) != 0x0001)
  61		return -EINVAL;
  62
  63	/* Restrict usage of well-known PSMs */
  64	if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65		return -EACCES;
  66
  67	return 0;
  68}
  69
  70static int l2cap_validate_le_psm(u16 psm)
  71{
  72	/* Valid LE_PSM ranges are defined only until 0x00ff */
  73	if (psm > L2CAP_PSM_LE_DYN_END)
  74		return -EINVAL;
  75
  76	/* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77	if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78		return -EACCES;
  79
  80	return 0;
  81}
  82
  83static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  84{
  85	struct sock *sk = sock->sk;
  86	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87	struct sockaddr_l2 la;
  88	int len, err = 0;
  89
  90	BT_DBG("sk %p", sk);
  91
  92	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93	    addr->sa_family != AF_BLUETOOTH)
  94		return -EINVAL;
  95
  96	memset(&la, 0, sizeof(la));
  97	len = min_t(unsigned int, sizeof(la), alen);
  98	memcpy(&la, addr, len);
  99
 100	if (la.l2_cid && la.l2_psm)
 101		return -EINVAL;
 102
 103	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104		return -EINVAL;
 105
 106	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107		/* We only allow ATT user space socket */
 108		if (la.l2_cid &&
 109		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110			return -EINVAL;
 111	}
 112
 113	lock_sock(sk);
 114
 115	if (sk->sk_state != BT_OPEN) {
 116		err = -EBADFD;
 117		goto done;
 118	}
 119
 120	if (la.l2_psm) {
 121		__u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123		if (la.l2_bdaddr_type == BDADDR_BREDR)
 124			err = l2cap_validate_bredr_psm(psm);
 125		else
 126			err = l2cap_validate_le_psm(psm);
 127
 128		if (err)
 129			goto done;
 130	}
 131
 132	bacpy(&chan->src, &la.l2_bdaddr);
 133	chan->src_type = la.l2_bdaddr_type;
 134
 135	if (la.l2_cid)
 136		err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137	else
 138		err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140	if (err < 0)
 141		goto done;
 142
 143	switch (chan->chan_type) {
 144	case L2CAP_CHAN_CONN_LESS:
 145		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146			chan->sec_level = BT_SECURITY_SDP;
 147		break;
 148	case L2CAP_CHAN_CONN_ORIENTED:
 149		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150		    __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151			chan->sec_level = BT_SECURITY_SDP;
 152		break;
 153	case L2CAP_CHAN_RAW:
 154		chan->sec_level = BT_SECURITY_SDP;
 155		break;
 156	case L2CAP_CHAN_FIXED:
 157		/* Fixed channels default to the L2CAP core not holding a
 158		 * hci_conn reference for them. For fixed channels mapping to
 159		 * L2CAP sockets we do want to hold a reference so set the
 160		 * appropriate flag to request it.
 161		 */
 162		set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163		break;
 164	}
 165
 166	/* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167	 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168	 */
 169	if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170	    chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173	chan->state = BT_BOUND;
 174	sk->sk_state = BT_BOUND;
 175
 176done:
 177	release_sock(sk);
 178	return err;
 179}
 180
 181static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 182			      int alen, int flags)
 183{
 184	struct sock *sk = sock->sk;
 185	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 186	struct sockaddr_l2 la;
 187	int len, err = 0;
 188	bool zapped;
 189
 190	BT_DBG("sk %p", sk);
 191
 192	lock_sock(sk);
 193	zapped = sock_flag(sk, SOCK_ZAPPED);
 194	release_sock(sk);
 195
 196	if (zapped)
 197		return -EINVAL;
 198
 199	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 200	    addr->sa_family != AF_BLUETOOTH)
 201		return -EINVAL;
 202
 203	memset(&la, 0, sizeof(la));
 204	len = min_t(unsigned int, sizeof(la), alen);
 205	memcpy(&la, addr, len);
 206
 207	if (la.l2_cid && la.l2_psm)
 208		return -EINVAL;
 209
 210	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 211		return -EINVAL;
 212
 213	/* Check that the socket wasn't bound to something that
 214	 * conflicts with the address given to connect(). If chan->src
 215	 * is BDADDR_ANY it means bind() was never used, in which case
 216	 * chan->src_type and la.l2_bdaddr_type do not need to match.
 217	 */
 218	if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 219	    bdaddr_type_is_le(la.l2_bdaddr_type)) {
 220		/* Old user space versions will try to incorrectly bind
 221		 * the ATT socket using BDADDR_BREDR. We need to accept
 222		 * this and fix up the source address type only when
 223		 * both the source CID and destination CID indicate
 224		 * ATT. Anything else is an invalid combination.
 225		 */
 226		if (chan->scid != L2CAP_CID_ATT ||
 227		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 228			return -EINVAL;
 229
 230		/* We don't have the hdev available here to make a
 231		 * better decision on random vs public, but since all
 232		 * user space versions that exhibit this issue anyway do
 233		 * not support random local addresses assuming public
 234		 * here is good enough.
 235		 */
 236		chan->src_type = BDADDR_LE_PUBLIC;
 237	}
 238
 239	if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 240		return -EINVAL;
 241
 242	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 243		/* We only allow ATT user space socket */
 244		if (la.l2_cid &&
 245		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 246			return -EINVAL;
 247	}
 248
 249	/* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 250	 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 251	 */
 252	if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 253	    chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 254		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 255
 256	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 257				 &la.l2_bdaddr, la.l2_bdaddr_type,
 258				 sk->sk_sndtimeo);
 259	if (err)
 260		return err;
 261
 262	lock_sock(sk);
 263
 264	err = bt_sock_wait_state(sk, BT_CONNECTED,
 265				 sock_sndtimeo(sk, flags & O_NONBLOCK));
 266
 267	release_sock(sk);
 268
 269	return err;
 270}
 271
 272static int l2cap_sock_listen(struct socket *sock, int backlog)
 273{
 274	struct sock *sk = sock->sk;
 275	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 276	int err = 0;
 277
 278	BT_DBG("sk %p backlog %d", sk, backlog);
 279
 280	lock_sock(sk);
 281
 282	if (sk->sk_state != BT_BOUND) {
 283		err = -EBADFD;
 284		goto done;
 285	}
 286
 287	if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 288		err = -EINVAL;
 289		goto done;
 290	}
 291
 292	switch (chan->mode) {
 293	case L2CAP_MODE_BASIC:
 294	case L2CAP_MODE_LE_FLOWCTL:
 295		break;
 296	case L2CAP_MODE_EXT_FLOWCTL:
 297		if (!enable_ecred) {
 298			err = -EOPNOTSUPP;
 299			goto done;
 300		}
 301		break;
 302	case L2CAP_MODE_ERTM:
 303	case L2CAP_MODE_STREAMING:
 304		if (!disable_ertm)
 305			break;
 306		fallthrough;
 307	default:
 308		err = -EOPNOTSUPP;
 309		goto done;
 310	}
 311
 312	sk->sk_max_ack_backlog = backlog;
 313	sk->sk_ack_backlog = 0;
 314
 315	/* Listening channels need to use nested locking in order not to
 316	 * cause lockdep warnings when the created child channels end up
 317	 * being locked in the same thread as the parent channel.
 318	 */
 319	atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 320
 321	chan->state = BT_LISTEN;
 322	sk->sk_state = BT_LISTEN;
 323
 324done:
 325	release_sock(sk);
 326	return err;
 327}
 328
 329static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 330			     struct proto_accept_arg *arg)
 331{
 332	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 333	struct sock *sk = sock->sk, *nsk;
 334	long timeo;
 335	int err = 0;
 336
 337	lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 338
 339	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
 340
 341	BT_DBG("sk %p timeo %ld", sk, timeo);
 342
 343	/* Wait for an incoming connection. (wake-one). */
 344	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 345	while (1) {
 346		if (sk->sk_state != BT_LISTEN) {
 347			err = -EBADFD;
 348			break;
 349		}
 350
 351		nsk = bt_accept_dequeue(sk, newsock);
 352		if (nsk)
 353			break;
 354
 355		if (!timeo) {
 356			err = -EAGAIN;
 357			break;
 358		}
 359
 360		if (signal_pending(current)) {
 361			err = sock_intr_errno(timeo);
 362			break;
 363		}
 364
 365		release_sock(sk);
 366
 367		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 368
 369		lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 370	}
 371	remove_wait_queue(sk_sleep(sk), &wait);
 372
 373	if (err)
 374		goto done;
 375
 376	newsock->state = SS_CONNECTED;
 377
 378	BT_DBG("new socket %p", nsk);
 379
 380done:
 381	release_sock(sk);
 382	return err;
 383}
 384
 385static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 386			      int peer)
 387{
 388	struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 389	struct sock *sk = sock->sk;
 390	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 391
 392	BT_DBG("sock %p, sk %p", sock, sk);
 393
 394	if (peer && sk->sk_state != BT_CONNECTED &&
 395	    sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 396	    sk->sk_state != BT_CONFIG)
 397		return -ENOTCONN;
 398
 399	memset(la, 0, sizeof(struct sockaddr_l2));
 400	addr->sa_family = AF_BLUETOOTH;
 401
 402	la->l2_psm = chan->psm;
 403
 404	if (peer) {
 405		bacpy(&la->l2_bdaddr, &chan->dst);
 406		la->l2_cid = cpu_to_le16(chan->dcid);
 407		la->l2_bdaddr_type = chan->dst_type;
 408	} else {
 409		bacpy(&la->l2_bdaddr, &chan->src);
 410		la->l2_cid = cpu_to_le16(chan->scid);
 411		la->l2_bdaddr_type = chan->src_type;
 412	}
 413
 414	return sizeof(struct sockaddr_l2);
 415}
 416
 417static int l2cap_get_mode(struct l2cap_chan *chan)
 418{
 419	switch (chan->mode) {
 420	case L2CAP_MODE_BASIC:
 421		return BT_MODE_BASIC;
 422	case L2CAP_MODE_ERTM:
 423		return BT_MODE_ERTM;
 424	case L2CAP_MODE_STREAMING:
 425		return BT_MODE_STREAMING;
 426	case L2CAP_MODE_LE_FLOWCTL:
 427		return BT_MODE_LE_FLOWCTL;
 428	case L2CAP_MODE_EXT_FLOWCTL:
 429		return BT_MODE_EXT_FLOWCTL;
 430	}
 431
 432	return -EINVAL;
 433}
 434
 435static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 436				     char __user *optval, int __user *optlen)
 437{
 438	struct sock *sk = sock->sk;
 439	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 440	struct l2cap_options opts;
 441	struct l2cap_conninfo cinfo;
 442	int err = 0;
 443	size_t len;
 444	u32 opt;
 445
 446	BT_DBG("sk %p", sk);
 447
 448	if (get_user(len, optlen))
 449		return -EFAULT;
 450
 451	lock_sock(sk);
 452
 453	switch (optname) {
 454	case L2CAP_OPTIONS:
 455		/* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 456		 * legacy ATT code depends on getsockopt for
 457		 * L2CAP_OPTIONS we need to let this pass.
 458		 */
 459		if (bdaddr_type_is_le(chan->src_type) &&
 460		    chan->scid != L2CAP_CID_ATT) {
 461			err = -EINVAL;
 462			break;
 463		}
 464
 465		/* Only BR/EDR modes are supported here */
 466		switch (chan->mode) {
 467		case L2CAP_MODE_BASIC:
 468		case L2CAP_MODE_ERTM:
 469		case L2CAP_MODE_STREAMING:
 470			break;
 471		default:
 472			err = -EINVAL;
 473			break;
 474		}
 475
 476		if (err < 0)
 477			break;
 478
 479		memset(&opts, 0, sizeof(opts));
 480		opts.imtu     = chan->imtu;
 481		opts.omtu     = chan->omtu;
 482		opts.flush_to = chan->flush_to;
 483		opts.mode     = chan->mode;
 484		opts.fcs      = chan->fcs;
 485		opts.max_tx   = chan->max_tx;
 486		opts.txwin_size = chan->tx_win;
 487
 488		BT_DBG("mode 0x%2.2x", chan->mode);
 489
 490		len = min(len, sizeof(opts));
 491		if (copy_to_user(optval, (char *) &opts, len))
 492			err = -EFAULT;
 493
 494		break;
 495
 496	case L2CAP_LM:
 497		switch (chan->sec_level) {
 498		case BT_SECURITY_LOW:
 499			opt = L2CAP_LM_AUTH;
 500			break;
 501		case BT_SECURITY_MEDIUM:
 502			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 503			break;
 504		case BT_SECURITY_HIGH:
 505			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 506			      L2CAP_LM_SECURE;
 507			break;
 508		case BT_SECURITY_FIPS:
 509			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 510			      L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 511			break;
 512		default:
 513			opt = 0;
 514			break;
 515		}
 516
 517		if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 518			opt |= L2CAP_LM_MASTER;
 519
 520		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 521			opt |= L2CAP_LM_RELIABLE;
 522
 523		if (put_user(opt, (u32 __user *) optval))
 524			err = -EFAULT;
 525
 526		break;
 527
 528	case L2CAP_CONNINFO:
 529		if (sk->sk_state != BT_CONNECTED &&
 530		    !(sk->sk_state == BT_CONNECT2 &&
 531		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 532			err = -ENOTCONN;
 533			break;
 534		}
 535
 536		memset(&cinfo, 0, sizeof(cinfo));
 537		cinfo.hci_handle = chan->conn->hcon->handle;
 538		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 539
 540		len = min(len, sizeof(cinfo));
 541		if (copy_to_user(optval, (char *) &cinfo, len))
 542			err = -EFAULT;
 543
 544		break;
 545
 546	default:
 547		err = -ENOPROTOOPT;
 548		break;
 549	}
 550
 551	release_sock(sk);
 552	return err;
 553}
 554
 555static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 556				 char __user *optval, int __user *optlen)
 557{
 558	struct sock *sk = sock->sk;
 559	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 560	struct bt_security sec;
 561	struct bt_power pwr;
 562	u32 phys;
 563	int len, mode, err = 0;
 564
 565	BT_DBG("sk %p", sk);
 566
 567	if (level == SOL_L2CAP)
 568		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 569
 570	if (level != SOL_BLUETOOTH)
 571		return -ENOPROTOOPT;
 572
 573	if (get_user(len, optlen))
 574		return -EFAULT;
 575
 576	lock_sock(sk);
 577
 578	switch (optname) {
 579	case BT_SECURITY:
 580		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 581		    chan->chan_type != L2CAP_CHAN_FIXED &&
 582		    chan->chan_type != L2CAP_CHAN_RAW) {
 583			err = -EINVAL;
 584			break;
 585		}
 586
 587		memset(&sec, 0, sizeof(sec));
 588		if (chan->conn) {
 589			sec.level = chan->conn->hcon->sec_level;
 590
 591			if (sk->sk_state == BT_CONNECTED)
 592				sec.key_size = chan->conn->hcon->enc_key_size;
 593		} else {
 594			sec.level = chan->sec_level;
 595		}
 596
 597		len = min_t(unsigned int, len, sizeof(sec));
 598		if (copy_to_user(optval, (char *) &sec, len))
 599			err = -EFAULT;
 600
 601		break;
 602
 603	case BT_DEFER_SETUP:
 604		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 605			err = -EINVAL;
 606			break;
 607		}
 608
 609		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 610			     (u32 __user *) optval))
 611			err = -EFAULT;
 612
 613		break;
 614
 615	case BT_FLUSHABLE:
 616		if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 617			     (u32 __user *) optval))
 618			err = -EFAULT;
 619
 620		break;
 621
 622	case BT_POWER:
 623		if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 624		    && sk->sk_type != SOCK_RAW) {
 625			err = -EINVAL;
 626			break;
 627		}
 628
 629		pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 630
 631		len = min_t(unsigned int, len, sizeof(pwr));
 632		if (copy_to_user(optval, (char *) &pwr, len))
 633			err = -EFAULT;
 634
 635		break;
 636
 637	case BT_CHANNEL_POLICY:
 638		if (put_user(chan->chan_policy, (u32 __user *) optval))
 639			err = -EFAULT;
 640		break;
 641
 642	case BT_SNDMTU:
 643		if (!bdaddr_type_is_le(chan->src_type)) {
 644			err = -EINVAL;
 645			break;
 646		}
 647
 648		if (sk->sk_state != BT_CONNECTED) {
 649			err = -ENOTCONN;
 650			break;
 651		}
 652
 653		if (put_user(chan->omtu, (u16 __user *) optval))
 654			err = -EFAULT;
 655		break;
 656
 657	case BT_RCVMTU:
 658		if (!bdaddr_type_is_le(chan->src_type)) {
 659			err = -EINVAL;
 660			break;
 661		}
 662
 663		if (put_user(chan->imtu, (u16 __user *) optval))
 664			err = -EFAULT;
 665		break;
 666
 667	case BT_PHY:
 668		if (sk->sk_state != BT_CONNECTED) {
 669			err = -ENOTCONN;
 670			break;
 671		}
 672
 673		phys = hci_conn_get_phy(chan->conn->hcon);
 674
 675		if (put_user(phys, (u32 __user *) optval))
 676			err = -EFAULT;
 677		break;
 678
 679	case BT_MODE:
 680		if (!enable_ecred) {
 681			err = -ENOPROTOOPT;
 682			break;
 683		}
 684
 685		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 686			err = -EINVAL;
 687			break;
 688		}
 689
 690		mode = l2cap_get_mode(chan);
 691		if (mode < 0) {
 692			err = mode;
 693			break;
 694		}
 695
 696		if (put_user(mode, (u8 __user *) optval))
 697			err = -EFAULT;
 698		break;
 699
 700	default:
 701		err = -ENOPROTOOPT;
 702		break;
 703	}
 704
 705	release_sock(sk);
 706	return err;
 707}
 708
 709static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 710{
 711	switch (chan->scid) {
 712	case L2CAP_CID_ATT:
 713		if (mtu && mtu < L2CAP_LE_MIN_MTU)
 714			return false;
 715		break;
 716
 717	default:
 718		if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU)
 719			return false;
 720	}
 721
 722	return true;
 723}
 724
 725static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 726				     sockptr_t optval, unsigned int optlen)
 727{
 728	struct sock *sk = sock->sk;
 729	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 730	struct l2cap_options opts;
 731	int err = 0;
 732	u32 opt;
 733
 734	BT_DBG("sk %p", sk);
 735
 736	lock_sock(sk);
 737
 738	switch (optname) {
 739	case L2CAP_OPTIONS:
 740		if (bdaddr_type_is_le(chan->src_type)) {
 741			err = -EINVAL;
 742			break;
 743		}
 744
 745		if (sk->sk_state == BT_CONNECTED) {
 746			err = -EINVAL;
 747			break;
 748		}
 749
 750		opts.imtu     = chan->imtu;
 751		opts.omtu     = chan->omtu;
 752		opts.flush_to = chan->flush_to;
 753		opts.mode     = chan->mode;
 754		opts.fcs      = chan->fcs;
 755		opts.max_tx   = chan->max_tx;
 756		opts.txwin_size = chan->tx_win;
 757
 758		err = copy_safe_from_sockptr(&opts, sizeof(opts), optval,
 759					     optlen);
 760		if (err)
 761			break;
 
 762
 763		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 764			err = -EINVAL;
 765			break;
 766		}
 767
 768		if (!l2cap_valid_mtu(chan, opts.imtu)) {
 769			err = -EINVAL;
 770			break;
 771		}
 772
 773		/* Only BR/EDR modes are supported here */
 774		switch (opts.mode) {
 
 
 775		case L2CAP_MODE_BASIC:
 776			clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 777			break;
 778		case L2CAP_MODE_ERTM:
 779		case L2CAP_MODE_STREAMING:
 780			if (!disable_ertm)
 781				break;
 782			fallthrough;
 783		default:
 784			err = -EINVAL;
 785			break;
 786		}
 787
 788		if (err < 0)
 789			break;
 790
 791		chan->mode = opts.mode;
 792
 793		BT_DBG("mode 0x%2.2x", chan->mode);
 794
 795		chan->imtu = opts.imtu;
 796		chan->omtu = opts.omtu;
 797		chan->fcs  = opts.fcs;
 798		chan->max_tx = opts.max_tx;
 799		chan->tx_win = opts.txwin_size;
 800		chan->flush_to = opts.flush_to;
 801		break;
 802
 803	case L2CAP_LM:
 804		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 805		if (err)
 806			break;
 
 807
 808		if (opt & L2CAP_LM_FIPS) {
 809			err = -EINVAL;
 810			break;
 811		}
 812
 813		if (opt & L2CAP_LM_AUTH)
 814			chan->sec_level = BT_SECURITY_LOW;
 815		if (opt & L2CAP_LM_ENCRYPT)
 816			chan->sec_level = BT_SECURITY_MEDIUM;
 817		if (opt & L2CAP_LM_SECURE)
 818			chan->sec_level = BT_SECURITY_HIGH;
 819
 820		if (opt & L2CAP_LM_MASTER)
 821			set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 822		else
 823			clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 824
 825		if (opt & L2CAP_LM_RELIABLE)
 826			set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 827		else
 828			clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 829		break;
 830
 831	default:
 832		err = -ENOPROTOOPT;
 833		break;
 834	}
 835
 836	release_sock(sk);
 837	return err;
 838}
 839
 840static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 841{
 842	switch (mode) {
 843	case BT_MODE_BASIC:
 844		if (bdaddr_type_is_le(chan->src_type))
 845			return -EINVAL;
 846		mode = L2CAP_MODE_BASIC;
 847		clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 848		break;
 849	case BT_MODE_ERTM:
 850		if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 851			return -EINVAL;
 852		mode = L2CAP_MODE_ERTM;
 853		break;
 854	case BT_MODE_STREAMING:
 855		if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 856			return -EINVAL;
 857		mode = L2CAP_MODE_STREAMING;
 858		break;
 859	case BT_MODE_LE_FLOWCTL:
 860		if (!bdaddr_type_is_le(chan->src_type))
 861			return -EINVAL;
 862		mode = L2CAP_MODE_LE_FLOWCTL;
 863		break;
 864	case BT_MODE_EXT_FLOWCTL:
 865		/* TODO: Add support for ECRED PDUs to BR/EDR */
 866		if (!bdaddr_type_is_le(chan->src_type))
 867			return -EINVAL;
 868		mode = L2CAP_MODE_EXT_FLOWCTL;
 869		break;
 870	default:
 871		return -EINVAL;
 872	}
 873
 874	chan->mode = mode;
 875
 876	return 0;
 877}
 878
 879static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 880				 sockptr_t optval, unsigned int optlen)
 881{
 882	struct sock *sk = sock->sk;
 883	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 884	struct bt_security sec;
 885	struct bt_power pwr;
 886	struct l2cap_conn *conn;
 887	int err = 0;
 888	u32 opt;
 889	u16 mtu;
 890	u8 mode;
 891
 892	BT_DBG("sk %p", sk);
 893
 894	if (level == SOL_L2CAP)
 895		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 896
 897	if (level != SOL_BLUETOOTH)
 898		return -ENOPROTOOPT;
 899
 900	lock_sock(sk);
 901
 902	switch (optname) {
 903	case BT_SECURITY:
 904		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 905		    chan->chan_type != L2CAP_CHAN_FIXED &&
 906		    chan->chan_type != L2CAP_CHAN_RAW) {
 907			err = -EINVAL;
 908			break;
 909		}
 910
 911		sec.level = BT_SECURITY_LOW;
 912
 913		err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
 914		if (err)
 
 915			break;
 
 916
 917		if (sec.level < BT_SECURITY_LOW ||
 918		    sec.level > BT_SECURITY_FIPS) {
 919			err = -EINVAL;
 920			break;
 921		}
 922
 923		chan->sec_level = sec.level;
 924
 925		if (!chan->conn)
 926			break;
 927
 928		conn = chan->conn;
 929
 930		/* change security for LE channels */
 931		if (chan->scid == L2CAP_CID_ATT) {
 932			if (smp_conn_security(conn->hcon, sec.level)) {
 933				err = -EINVAL;
 934				break;
 935			}
 936
 937			set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 938			sk->sk_state = BT_CONFIG;
 939			chan->state = BT_CONFIG;
 940
 941		/* or for ACL link */
 942		} else if ((sk->sk_state == BT_CONNECT2 &&
 943			    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 944			   sk->sk_state == BT_CONNECTED) {
 945			if (!l2cap_chan_check_security(chan, true))
 946				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 947			else
 948				sk->sk_state_change(sk);
 949		} else {
 950			err = -EINVAL;
 951		}
 952		break;
 953
 954	case BT_DEFER_SETUP:
 955		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 956			err = -EINVAL;
 957			break;
 958		}
 959
 960		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 961		if (err)
 962			break;
 
 963
 964		if (opt) {
 965			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 966			set_bit(FLAG_DEFER_SETUP, &chan->flags);
 967		} else {
 968			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 969			clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 970		}
 971		break;
 972
 973	case BT_FLUSHABLE:
 974		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 975		if (err)
 976			break;
 
 977
 978		if (opt > BT_FLUSHABLE_ON) {
 979			err = -EINVAL;
 980			break;
 981		}
 982
 983		if (opt == BT_FLUSHABLE_OFF) {
 984			conn = chan->conn;
 985			/* proceed further only when we have l2cap_conn and
 986			   No Flush support in the LM */
 987			if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 988				err = -EINVAL;
 989				break;
 990			}
 991		}
 992
 993		if (opt)
 994			set_bit(FLAG_FLUSHABLE, &chan->flags);
 995		else
 996			clear_bit(FLAG_FLUSHABLE, &chan->flags);
 997		break;
 998
 999	case BT_POWER:
1000		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1001		    chan->chan_type != L2CAP_CHAN_RAW) {
1002			err = -EINVAL;
1003			break;
1004		}
1005
1006		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1007
1008		err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1009		if (err)
 
1010			break;
 
1011
1012		if (pwr.force_active)
1013			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1014		else
1015			clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1016		break;
1017
1018	case BT_CHANNEL_POLICY:
1019		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1020		if (err)
1021			break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1022
1023		err = -EOPNOTSUPP;
1024		break;
1025
1026	case BT_SNDMTU:
1027		if (!bdaddr_type_is_le(chan->src_type)) {
1028			err = -EINVAL;
1029			break;
1030		}
1031
1032		/* Setting is not supported as it's the remote side that
1033		 * decides this.
1034		 */
1035		err = -EPERM;
1036		break;
1037
1038	case BT_RCVMTU:
1039		if (!bdaddr_type_is_le(chan->src_type)) {
1040			err = -EINVAL;
1041			break;
1042		}
1043
1044		if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1045		    sk->sk_state == BT_CONNECTED) {
1046			err = -EISCONN;
1047			break;
1048		}
1049
1050		err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1051		if (err)
1052			break;
1053
1054		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1055		    sk->sk_state == BT_CONNECTED)
1056			err = l2cap_chan_reconfigure(chan, mtu);
1057		else
1058			chan->imtu = mtu;
1059
1060		break;
1061
1062	case BT_MODE:
1063		if (!enable_ecred) {
1064			err = -ENOPROTOOPT;
1065			break;
1066		}
1067
1068		BT_DBG("sk->sk_state %u", sk->sk_state);
1069
1070		if (sk->sk_state != BT_BOUND) {
1071			err = -EINVAL;
1072			break;
1073		}
1074
1075		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1076			err = -EINVAL;
1077			break;
1078		}
1079
1080		err = copy_safe_from_sockptr(&mode, sizeof(mode), optval,
1081					     optlen);
1082		if (err)
1083			break;
1084
1085		BT_DBG("mode %u", mode);
1086
1087		err = l2cap_set_mode(chan, mode);
1088		if (err)
1089			break;
1090
1091		BT_DBG("mode 0x%2.2x", chan->mode);
1092
1093		break;
1094
1095	default:
1096		err = -ENOPROTOOPT;
1097		break;
1098	}
1099
1100	release_sock(sk);
1101	return err;
1102}
1103
1104static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1105			      size_t len)
1106{
1107	struct sock *sk = sock->sk;
1108	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1109	int err;
1110
1111	BT_DBG("sock %p, sk %p", sock, sk);
1112
1113	err = sock_error(sk);
1114	if (err)
1115		return err;
1116
1117	if (msg->msg_flags & MSG_OOB)
1118		return -EOPNOTSUPP;
1119
1120	if (sk->sk_state != BT_CONNECTED)
1121		return -ENOTCONN;
1122
1123	lock_sock(sk);
1124	err = bt_sock_wait_ready(sk, msg->msg_flags);
1125	release_sock(sk);
1126	if (err)
1127		return err;
1128
1129	l2cap_chan_lock(chan);
1130	err = l2cap_chan_send(chan, msg, len);
1131	l2cap_chan_unlock(chan);
1132
1133	return err;
1134}
1135
1136static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
1137{
1138	struct sock *sk = chan->data;
1139	ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc);
1140	int expected_skbs, skb_overhead;
1141
1142	if (avail <= 0) {
1143		l2cap_chan_rx_avail(chan, 0);
1144		return;
1145	}
1146
1147	if (!chan->mps) {
1148		l2cap_chan_rx_avail(chan, -1);
1149		return;
1150	}
1151
1152	/* Correct available memory by estimated sk_buff overhead.
1153	 * This is significant due to small transfer sizes. However, accept
1154	 * at least one full packet if receive space is non-zero.
1155	 */
1156	expected_skbs = DIV_ROUND_UP(avail, chan->mps);
1157	skb_overhead = expected_skbs * sizeof(struct sk_buff);
1158	if (skb_overhead < avail)
1159		l2cap_chan_rx_avail(chan, avail - skb_overhead);
1160	else
1161		l2cap_chan_rx_avail(chan, -1);
1162}
1163
1164static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1165			      size_t len, int flags)
1166{
1167	struct sock *sk = sock->sk;
1168	struct l2cap_pinfo *pi = l2cap_pi(sk);
1169	int err;
1170
1171	lock_sock(sk);
1172
1173	if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1174						    &bt_sk(sk)->flags)) {
1175		if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1176			sk->sk_state = BT_CONNECTED;
1177			pi->chan->state = BT_CONNECTED;
1178			__l2cap_ecred_conn_rsp_defer(pi->chan);
1179		} else if (bdaddr_type_is_le(pi->chan->src_type)) {
1180			sk->sk_state = BT_CONNECTED;
1181			pi->chan->state = BT_CONNECTED;
1182			__l2cap_le_connect_rsp_defer(pi->chan);
1183		} else {
1184			sk->sk_state = BT_CONFIG;
1185			pi->chan->state = BT_CONFIG;
1186			__l2cap_connect_rsp_defer(pi->chan);
1187		}
1188
1189		err = 0;
1190		goto done;
1191	}
1192
1193	release_sock(sk);
1194
1195	if (sock->type == SOCK_STREAM)
1196		err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1197	else
1198		err = bt_sock_recvmsg(sock, msg, len, flags);
1199
1200	if (pi->chan->mode != L2CAP_MODE_ERTM &&
1201	    pi->chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1202	    pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL)
1203		return err;
1204
 
 
1205	lock_sock(sk);
1206
1207	l2cap_publish_rx_avail(pi->chan);
 
1208
1209	/* Attempt to put pending rx data in the socket buffer */
1210	while (!list_empty(&pi->rx_busy)) {
1211		struct l2cap_rx_busy *rx_busy =
1212			list_first_entry(&pi->rx_busy,
1213					 struct l2cap_rx_busy,
1214					 list);
1215		if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0)
1216			goto done;
1217		list_del(&rx_busy->list);
1218		kfree(rx_busy);
1219	}
1220
1221	/* Restore data flow when half of the receive buffer is
1222	 * available.  This avoids resending large numbers of
1223	 * frames.
1224	 */
1225	if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) &&
1226	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1227		l2cap_chan_busy(pi->chan, 0);
1228
1229done:
1230	release_sock(sk);
1231	return err;
1232}
1233
1234/* Kill socket (only if zapped and orphan)
1235 * Must be called on unlocked socket, with l2cap channel lock.
1236 */
1237static void l2cap_sock_kill(struct sock *sk)
1238{
1239	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1240		return;
1241
1242	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1243
1244	/* Sock is dead, so set chan data to NULL, avoid other task use invalid
1245	 * sock pointer.
1246	 */
1247	l2cap_pi(sk)->chan->data = NULL;
1248	/* Kill poor orphan */
1249
1250	l2cap_chan_put(l2cap_pi(sk)->chan);
1251	sock_set_flag(sk, SOCK_DEAD);
1252	sock_put(sk);
1253}
1254
1255static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1256{
1257	DECLARE_WAITQUEUE(wait, current);
1258	int err = 0;
1259	int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1260	/* Timeout to prevent infinite loop */
1261	unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1262
1263	add_wait_queue(sk_sleep(sk), &wait);
1264	set_current_state(TASK_INTERRUPTIBLE);
1265	do {
1266		BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1267		       chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1268		       jiffies_to_msecs(timeout - jiffies));
1269
1270		if (!timeo)
1271			timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1272
1273		if (signal_pending(current)) {
1274			err = sock_intr_errno(timeo);
1275			break;
1276		}
1277
1278		release_sock(sk);
1279		timeo = schedule_timeout(timeo);
1280		lock_sock(sk);
1281		set_current_state(TASK_INTERRUPTIBLE);
1282
1283		err = sock_error(sk);
1284		if (err)
1285			break;
1286
1287		if (time_after(jiffies, timeout)) {
1288			err = -ENOLINK;
1289			break;
1290		}
1291
1292	} while (chan->unacked_frames > 0 &&
1293		 chan->state == BT_CONNECTED);
1294
1295	set_current_state(TASK_RUNNING);
1296	remove_wait_queue(sk_sleep(sk), &wait);
1297	return err;
1298}
1299
1300static int l2cap_sock_shutdown(struct socket *sock, int how)
1301{
1302	struct sock *sk = sock->sk;
1303	struct l2cap_chan *chan;
1304	struct l2cap_conn *conn;
1305	int err = 0;
1306
1307	BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1308
1309	/* 'how' parameter is mapped to sk_shutdown as follows:
1310	 * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1311	 * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1312	 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1313	 */
1314	how++;
1315
1316	if (!sk)
1317		return 0;
1318
1319	lock_sock(sk);
1320
1321	if ((sk->sk_shutdown & how) == how)
1322		goto shutdown_already;
1323
1324	BT_DBG("Handling sock shutdown");
1325
1326	/* prevent sk structure from being freed whilst unlocked */
1327	sock_hold(sk);
1328
1329	chan = l2cap_pi(sk)->chan;
1330	/* prevent chan structure from being freed whilst unlocked */
1331	l2cap_chan_hold(chan);
1332
1333	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1334
1335	if (chan->mode == L2CAP_MODE_ERTM &&
1336	    chan->unacked_frames > 0 &&
1337	    chan->state == BT_CONNECTED) {
1338		err = __l2cap_wait_ack(sk, chan);
1339
1340		/* After waiting for ACKs, check whether shutdown
1341		 * has already been actioned to close the L2CAP
1342		 * link such as by l2cap_disconnection_req().
1343		 */
1344		if ((sk->sk_shutdown & how) == how)
1345			goto shutdown_matched;
1346	}
1347
1348	/* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1349	 * is already set
1350	 */
1351	if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1352		sk->sk_shutdown |= RCV_SHUTDOWN;
1353		if ((sk->sk_shutdown & how) == how)
1354			goto shutdown_matched;
1355	}
1356
1357	sk->sk_shutdown |= SEND_SHUTDOWN;
1358	release_sock(sk);
1359
1360	l2cap_chan_lock(chan);
1361	conn = chan->conn;
1362	if (conn)
1363		/* prevent conn structure from being freed */
1364		l2cap_conn_get(conn);
1365	l2cap_chan_unlock(chan);
1366
1367	if (conn)
1368		/* mutex lock must be taken before l2cap_chan_lock() */
1369		mutex_lock(&conn->chan_lock);
1370
1371	l2cap_chan_lock(chan);
1372	l2cap_chan_close(chan, 0);
1373	l2cap_chan_unlock(chan);
1374
1375	if (conn) {
1376		mutex_unlock(&conn->chan_lock);
1377		l2cap_conn_put(conn);
1378	}
1379
1380	lock_sock(sk);
1381
1382	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1383	    !(current->flags & PF_EXITING))
1384		err = bt_sock_wait_state(sk, BT_CLOSED,
1385					 sk->sk_lingertime);
1386
1387shutdown_matched:
1388	l2cap_chan_put(chan);
1389	sock_put(sk);
1390
1391shutdown_already:
1392	if (!err && sk->sk_err)
1393		err = -sk->sk_err;
1394
1395	release_sock(sk);
1396
1397	BT_DBG("Sock shutdown complete err: %d", err);
1398
1399	return err;
1400}
1401
1402static int l2cap_sock_release(struct socket *sock)
1403{
1404	struct sock *sk = sock->sk;
1405	int err;
1406	struct l2cap_chan *chan;
1407
1408	BT_DBG("sock %p, sk %p", sock, sk);
1409
1410	if (!sk)
1411		return 0;
1412
1413	l2cap_sock_cleanup_listen(sk);
1414	bt_sock_unlink(&l2cap_sk_list, sk);
1415
1416	err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1417	chan = l2cap_pi(sk)->chan;
1418
1419	l2cap_chan_hold(chan);
1420	l2cap_chan_lock(chan);
1421
1422	sock_orphan(sk);
1423	l2cap_sock_kill(sk);
1424
1425	l2cap_chan_unlock(chan);
1426	l2cap_chan_put(chan);
1427
1428	return err;
1429}
1430
1431static void l2cap_sock_cleanup_listen(struct sock *parent)
1432{
1433	struct sock *sk;
1434
1435	BT_DBG("parent %p state %s", parent,
1436	       state_to_string(parent->sk_state));
1437
1438	/* Close not yet accepted channels */
1439	while ((sk = bt_accept_dequeue(parent, NULL))) {
1440		struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1441
1442		BT_DBG("child chan %p state %s", chan,
1443		       state_to_string(chan->state));
1444
1445		l2cap_chan_hold(chan);
1446		l2cap_chan_lock(chan);
1447
1448		__clear_chan_timer(chan);
1449		l2cap_chan_close(chan, ECONNRESET);
1450		l2cap_sock_kill(sk);
1451
1452		l2cap_chan_unlock(chan);
1453		l2cap_chan_put(chan);
 
1454	}
1455}
1456
1457static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1458{
1459	struct sock *sk, *parent = chan->data;
1460
1461	lock_sock(parent);
1462
1463	/* Check for backlog size */
1464	if (sk_acceptq_is_full(parent)) {
1465		BT_DBG("backlog full %d", parent->sk_ack_backlog);
1466		release_sock(parent);
1467		return NULL;
1468	}
1469
1470	sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1471			      GFP_ATOMIC, 0);
1472	if (!sk) {
1473		release_sock(parent);
1474		return NULL;
1475        }
1476
1477	bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1478
1479	l2cap_sock_init(sk, parent);
1480
1481	bt_accept_enqueue(parent, sk, false);
1482
1483	release_sock(parent);
1484
1485	return l2cap_pi(sk)->chan;
1486}
1487
1488static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1489{
1490	struct sock *sk;
1491	struct l2cap_pinfo *pi;
1492	int err;
1493
1494	sk = chan->data;
1495	if (!sk)
1496		return -ENXIO;
1497
1498	pi = l2cap_pi(sk);
1499	lock_sock(sk);
1500	if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
 
1501		err = -ENOMEM;
1502		goto done;
1503	}
1504
1505	if (chan->mode != L2CAP_MODE_ERTM &&
1506	    chan->mode != L2CAP_MODE_STREAMING &&
1507	    chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1508	    chan->mode != L2CAP_MODE_EXT_FLOWCTL) {
1509		/* Even if no filter is attached, we could potentially
1510		 * get errors from security modules, etc.
1511		 */
1512		err = sk_filter(sk, skb);
1513		if (err)
1514			goto done;
1515	}
1516
1517	err = __sock_queue_rcv_skb(sk, skb);
1518
1519	l2cap_publish_rx_avail(chan);
1520
1521	/* For ERTM and LE, handle a skb that doesn't fit into the recv
1522	 * buffer.  This is important to do because the data frames
1523	 * have already been acked, so the skb cannot be discarded.
1524	 *
1525	 * Notify the l2cap core that the buffer is full, so the
1526	 * LOCAL_BUSY state is entered and no more frames are
1527	 * acked and reassembled until there is buffer space
1528	 * available.
1529	 */
1530	if (err < 0 &&
1531	    (chan->mode == L2CAP_MODE_ERTM ||
1532	     chan->mode == L2CAP_MODE_LE_FLOWCTL ||
1533	     chan->mode == L2CAP_MODE_EXT_FLOWCTL)) {
1534		struct l2cap_rx_busy *rx_busy =
1535			kmalloc(sizeof(*rx_busy), GFP_KERNEL);
1536		if (!rx_busy) {
1537			err = -ENOMEM;
1538			goto done;
1539		}
1540		rx_busy->skb = skb;
1541		list_add_tail(&rx_busy->list, &pi->rx_busy);
1542		l2cap_chan_busy(chan, 1);
1543		err = 0;
1544	}
1545
1546done:
1547	release_sock(sk);
1548
1549	return err;
1550}
1551
1552static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1553{
1554	struct sock *sk = chan->data;
1555
1556	if (!sk)
1557		return;
1558
1559	l2cap_sock_kill(sk);
1560}
1561
1562static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1563{
1564	struct sock *sk = chan->data;
1565	struct sock *parent;
1566
1567	if (!sk)
1568		return;
1569
1570	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1571
1572	/* This callback can be called both for server (BT_LISTEN)
1573	 * sockets as well as "normal" ones. To avoid lockdep warnings
1574	 * with child socket locking (through l2cap_sock_cleanup_listen)
1575	 * we need separation into separate nesting levels. The simplest
1576	 * way to accomplish this is to inherit the nesting level used
1577	 * for the channel.
1578	 */
1579	lock_sock_nested(sk, atomic_read(&chan->nesting));
1580
1581	parent = bt_sk(sk)->parent;
1582
 
 
1583	switch (chan->state) {
1584	case BT_OPEN:
1585	case BT_BOUND:
1586	case BT_CLOSED:
1587		break;
1588	case BT_LISTEN:
1589		l2cap_sock_cleanup_listen(sk);
1590		sk->sk_state = BT_CLOSED;
1591		chan->state = BT_CLOSED;
1592
1593		break;
1594	default:
1595		sk->sk_state = BT_CLOSED;
1596		chan->state = BT_CLOSED;
1597
1598		sk->sk_err = err;
1599
1600		if (parent) {
1601			bt_accept_unlink(sk);
1602			parent->sk_data_ready(parent);
1603		} else {
1604			sk->sk_state_change(sk);
1605		}
1606
1607		break;
1608	}
1609	release_sock(sk);
1610
1611	/* Only zap after cleanup to avoid use after free race */
1612	sock_set_flag(sk, SOCK_ZAPPED);
1613
 
1614}
1615
1616static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1617				       int err)
1618{
1619	struct sock *sk = chan->data;
1620
1621	sk->sk_state = state;
1622
1623	if (err)
1624		sk->sk_err = err;
1625}
1626
1627static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1628					       unsigned long hdr_len,
1629					       unsigned long len, int nb)
1630{
1631	struct sock *sk = chan->data;
1632	struct sk_buff *skb;
1633	int err;
1634
1635	l2cap_chan_unlock(chan);
1636	skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1637	l2cap_chan_lock(chan);
1638
1639	if (!skb)
1640		return ERR_PTR(err);
1641
1642	/* Channel lock is released before requesting new skb and then
1643	 * reacquired thus we need to recheck channel state.
1644	 */
1645	if (chan->state != BT_CONNECTED) {
1646		kfree_skb(skb);
1647		return ERR_PTR(-ENOTCONN);
1648	}
1649
1650	skb->priority = READ_ONCE(sk->sk_priority);
1651
1652	bt_cb(skb)->l2cap.chan = chan;
1653
1654	return skb;
1655}
1656
1657static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1658{
1659	struct sock *sk = chan->data;
1660	struct sock *parent;
1661
1662	lock_sock(sk);
1663
1664	parent = bt_sk(sk)->parent;
1665
1666	BT_DBG("sk %p, parent %p", sk, parent);
1667
1668	sk->sk_state = BT_CONNECTED;
1669	sk->sk_state_change(sk);
1670
1671	if (parent)
1672		parent->sk_data_ready(parent);
1673
1674	release_sock(sk);
1675}
1676
1677static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1678{
1679	struct sock *parent, *sk = chan->data;
1680
1681	lock_sock(sk);
1682
1683	parent = bt_sk(sk)->parent;
1684	if (parent)
1685		parent->sk_data_ready(parent);
1686
1687	release_sock(sk);
1688}
1689
1690static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1691{
1692	struct sock *sk = chan->data;
1693
1694	if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1695		sk->sk_state = BT_CONNECTED;
1696		chan->state = BT_CONNECTED;
1697	}
1698
1699	clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1700	sk->sk_state_change(sk);
1701}
1702
1703static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1704{
1705	struct sock *sk = chan->data;
1706
1707	lock_sock(sk);
1708	sk->sk_shutdown = SHUTDOWN_MASK;
1709	release_sock(sk);
1710}
1711
1712static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1713{
1714	struct sock *sk = chan->data;
1715
1716	return sk->sk_sndtimeo;
1717}
1718
1719static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1720{
1721	struct sock *sk = chan->data;
1722
1723	return sk->sk_peer_pid;
1724}
1725
1726static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1727{
1728	struct sock *sk = chan->data;
1729
1730	set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1731	sk->sk_state_change(sk);
1732}
1733
1734static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1735{
1736	struct sock *sk = chan->data;
1737
1738	switch (chan->mode) {
1739	case L2CAP_MODE_ERTM:
1740	case L2CAP_MODE_STREAMING:
1741		return sk_filter(sk, skb);
1742	}
1743
1744	return 0;
1745}
1746
1747static const struct l2cap_ops l2cap_chan_ops = {
1748	.name			= "L2CAP Socket Interface",
1749	.new_connection		= l2cap_sock_new_connection_cb,
1750	.recv			= l2cap_sock_recv_cb,
1751	.close			= l2cap_sock_close_cb,
1752	.teardown		= l2cap_sock_teardown_cb,
1753	.state_change		= l2cap_sock_state_change_cb,
1754	.ready			= l2cap_sock_ready_cb,
1755	.defer			= l2cap_sock_defer_cb,
1756	.resume			= l2cap_sock_resume_cb,
1757	.suspend		= l2cap_sock_suspend_cb,
1758	.set_shutdown		= l2cap_sock_set_shutdown_cb,
1759	.get_sndtimeo		= l2cap_sock_get_sndtimeo_cb,
1760	.get_peer_pid		= l2cap_sock_get_peer_pid_cb,
1761	.alloc_skb		= l2cap_sock_alloc_skb_cb,
1762	.filter			= l2cap_sock_filter,
1763};
1764
1765static void l2cap_sock_destruct(struct sock *sk)
1766{
1767	struct l2cap_rx_busy *rx_busy, *next;
1768
1769	BT_DBG("sk %p", sk);
1770
1771	if (l2cap_pi(sk)->chan) {
1772		l2cap_pi(sk)->chan->data = NULL;
1773		l2cap_chan_put(l2cap_pi(sk)->chan);
1774	}
1775
1776	list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) {
1777		kfree_skb(rx_busy->skb);
1778		list_del(&rx_busy->list);
1779		kfree(rx_busy);
1780	}
1781
1782	skb_queue_purge(&sk->sk_receive_queue);
1783	skb_queue_purge(&sk->sk_write_queue);
1784}
1785
1786static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1787			       int *msg_namelen)
1788{
1789	DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1790
1791	memset(la, 0, sizeof(struct sockaddr_l2));
1792	la->l2_family = AF_BLUETOOTH;
1793	la->l2_psm = bt_cb(skb)->l2cap.psm;
1794	bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1795
1796	*msg_namelen = sizeof(struct sockaddr_l2);
1797}
1798
1799static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1800{
1801	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1802
1803	BT_DBG("sk %p", sk);
1804
1805	if (parent) {
1806		struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1807
1808		sk->sk_type = parent->sk_type;
1809		bt_sk(sk)->flags = bt_sk(parent)->flags;
1810
1811		chan->chan_type = pchan->chan_type;
1812		chan->imtu = pchan->imtu;
1813		chan->omtu = pchan->omtu;
1814		chan->conf_state = pchan->conf_state;
1815		chan->mode = pchan->mode;
1816		chan->fcs  = pchan->fcs;
1817		chan->max_tx = pchan->max_tx;
1818		chan->tx_win = pchan->tx_win;
1819		chan->tx_win_max = pchan->tx_win_max;
1820		chan->sec_level = pchan->sec_level;
1821		chan->flags = pchan->flags;
1822		chan->tx_credits = pchan->tx_credits;
1823		chan->rx_credits = pchan->rx_credits;
1824
1825		if (chan->chan_type == L2CAP_CHAN_FIXED) {
1826			chan->scid = pchan->scid;
1827			chan->dcid = pchan->scid;
1828		}
1829
1830		security_sk_clone(parent, sk);
1831	} else {
1832		switch (sk->sk_type) {
1833		case SOCK_RAW:
1834			chan->chan_type = L2CAP_CHAN_RAW;
1835			break;
1836		case SOCK_DGRAM:
1837			chan->chan_type = L2CAP_CHAN_CONN_LESS;
1838			bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1839			break;
1840		case SOCK_SEQPACKET:
1841		case SOCK_STREAM:
1842			chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1843			break;
1844		}
1845
1846		chan->imtu = L2CAP_DEFAULT_MTU;
1847		chan->omtu = 0;
1848		if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1849			chan->mode = L2CAP_MODE_ERTM;
1850			set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1851		} else {
1852			chan->mode = L2CAP_MODE_BASIC;
1853		}
1854
1855		l2cap_chan_set_defaults(chan);
1856	}
1857
1858	/* Default config options */
1859	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1860
1861	chan->data = sk;
1862	chan->ops = &l2cap_chan_ops;
1863
1864	l2cap_publish_rx_avail(chan);
1865}
1866
1867static struct proto l2cap_proto = {
1868	.name		= "L2CAP",
1869	.owner		= THIS_MODULE,
1870	.obj_size	= sizeof(struct l2cap_pinfo)
1871};
1872
1873static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1874				     int proto, gfp_t prio, int kern)
1875{
1876	struct sock *sk;
1877	struct l2cap_chan *chan;
1878
1879	sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
1880	if (!sk)
1881		return NULL;
1882
 
 
 
1883	sk->sk_destruct = l2cap_sock_destruct;
1884	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1885
1886	INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy);
 
 
 
1887
1888	chan = l2cap_chan_create();
1889	if (!chan) {
1890		sk_free(sk);
1891		if (sock)
1892			sock->sk = NULL;
1893		return NULL;
1894	}
1895
1896	l2cap_chan_hold(chan);
1897
1898	l2cap_pi(sk)->chan = chan;
1899
1900	return sk;
1901}
1902
1903static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1904			     int kern)
1905{
1906	struct sock *sk;
1907
1908	BT_DBG("sock %p", sock);
1909
1910	sock->state = SS_UNCONNECTED;
1911
1912	if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1913	    sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1914		return -ESOCKTNOSUPPORT;
1915
1916	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1917		return -EPERM;
1918
1919	sock->ops = &l2cap_sock_ops;
1920
1921	sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1922	if (!sk)
1923		return -ENOMEM;
1924
1925	l2cap_sock_init(sk, NULL);
1926	bt_sock_link(&l2cap_sk_list, sk);
1927	return 0;
1928}
1929
1930static const struct proto_ops l2cap_sock_ops = {
1931	.family		= PF_BLUETOOTH,
1932	.owner		= THIS_MODULE,
1933	.release	= l2cap_sock_release,
1934	.bind		= l2cap_sock_bind,
1935	.connect	= l2cap_sock_connect,
1936	.listen		= l2cap_sock_listen,
1937	.accept		= l2cap_sock_accept,
1938	.getname	= l2cap_sock_getname,
1939	.sendmsg	= l2cap_sock_sendmsg,
1940	.recvmsg	= l2cap_sock_recvmsg,
1941	.poll		= bt_sock_poll,
1942	.ioctl		= bt_sock_ioctl,
1943	.gettstamp	= sock_gettstamp,
1944	.mmap		= sock_no_mmap,
1945	.socketpair	= sock_no_socketpair,
1946	.shutdown	= l2cap_sock_shutdown,
1947	.setsockopt	= l2cap_sock_setsockopt,
1948	.getsockopt	= l2cap_sock_getsockopt
1949};
1950
1951static const struct net_proto_family l2cap_sock_family_ops = {
1952	.family	= PF_BLUETOOTH,
1953	.owner	= THIS_MODULE,
1954	.create	= l2cap_sock_create,
1955};
1956
1957int __init l2cap_init_sockets(void)
1958{
1959	int err;
1960
1961	BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1962
1963	err = proto_register(&l2cap_proto, 0);
1964	if (err < 0)
1965		return err;
1966
1967	err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1968	if (err < 0) {
1969		BT_ERR("L2CAP socket registration failed");
1970		goto error;
1971	}
1972
1973	err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1974			     NULL);
1975	if (err < 0) {
1976		BT_ERR("Failed to create L2CAP proc file");
1977		bt_sock_unregister(BTPROTO_L2CAP);
1978		goto error;
1979	}
1980
1981	BT_INFO("L2CAP socket layer initialized");
1982
1983	return 0;
1984
1985error:
1986	proto_unregister(&l2cap_proto);
1987	return err;
1988}
1989
1990void l2cap_cleanup_sockets(void)
1991{
1992	bt_procfs_cleanup(&init_net, "l2cap");
1993	bt_sock_unregister(BTPROTO_L2CAP);
1994	proto_unregister(&l2cap_proto);
1995}