net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <[email protected]>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <[email protected]>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/filter.h>
  33 #include <linux/sched/signal.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38
  39 #include "smp.h"
  40
  41 static struct bt_sock_list l2cap_sk_list = {
  42         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43 };
  44
  45 static const struct proto_ops l2cap_sock_ops;
  46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48                                      int proto, gfp_t prio, int kern);
  49 static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51 bool l2cap_is_socket(struct socket *sock)
  52 {
  53         return sock && sock->ops == &l2cap_sock_ops;
  54 }
  55 EXPORT_SYMBOL(l2cap_is_socket);
  56
  57 static int l2cap_validate_bredr_psm(u16 psm)
  58 {
  59         /* PSM must be odd and lsb of upper byte must be 0 */
  60         if ((psm & 0x0101) != 0x0001)
  61                 return -EINVAL;
  62
  63         /* Restrict usage of well-known PSMs */
  64         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65                 return -EACCES;
  66
  67         return 0;
  68 }
  69
  70 static int l2cap_validate_le_psm(u16 psm)
  71 {
  72         /* Valid LE_PSM ranges are defined only until 0x00ff */
  73         if (psm > L2CAP_PSM_LE_DYN_END)
  74                 return -EINVAL;
  75
  76         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78                 return -EACCES;
  79
  80         return 0;
  81 }
  82
  83 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  84 {
  85         struct sock *sk = sock->sk;
  86         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87         struct sockaddr_l2 la;
  88         int len, err = 0;
  89
  90         BT_DBG("sk %p", sk);
  91
  92         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93             addr->sa_family != AF_BLUETOOTH)
  94                 return -EINVAL;
  95
  96         memset(&la, 0, sizeof(la));
  97         len = min_t(unsigned int, sizeof(la), alen);
  98         memcpy(&la, addr, len);
  99
 100         if (la.l2_cid && la.l2_psm)
 101                 return -EINVAL;
 102
 103         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104                 return -EINVAL;
 105
 106         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107                 /* We only allow ATT user space socket */
 108                 if (la.l2_cid &&
 109                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110                         return -EINVAL;
 111         }
 112
 113         lock_sock(sk);
 114
 115         if (sk->sk_state != BT_OPEN) {
 116                 err = -EBADFD;
 117                 goto done;
 118         }
 119
 120         if (la.l2_psm) {
 121                 __u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 124                         err = l2cap_validate_bredr_psm(psm);
 125                 else
 126                         err = l2cap_validate_le_psm(psm);
 127
 128                 if (err)
 129                         goto done;
 130         }
 131
 132         bacpy(&chan->src, &la.l2_bdaddr);
 133         chan->src_type = la.l2_bdaddr_type;
 134
 135         if (la.l2_cid)
 136                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137         else
 138                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140         if (err < 0)
 141                 goto done;
 142
 143         switch (chan->chan_type) {
 144         case L2CAP_CHAN_CONN_LESS:
 145                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146                         chan->sec_level = BT_SECURITY_SDP;
 147                 break;
 148         case L2CAP_CHAN_CONN_ORIENTED:
 149                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151                         chan->sec_level = BT_SECURITY_SDP;
 152                 break;
 153         case L2CAP_CHAN_RAW:
 154                 chan->sec_level = BT_SECURITY_SDP;
 155                 break;
 156         case L2CAP_CHAN_FIXED:
 157                 /* Fixed channels default to the L2CAP core not holding a
 158                  * hci_conn reference for them. For fixed channels mapping to
 159                  * L2CAP sockets we do want to hold a reference so set the
 160                  * appropriate flag to request it.
 161                  */
 162                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163                 break;
 164         }
 165
 166         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168          */
 169         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173         chan->state = BT_BOUND;
 174         sk->sk_state = BT_BOUND;
 175
 176 done:
 177         release_sock(sk);
 178         return err;
 179 }
 180
 181 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 182                               int alen, int flags)
 183 {
 184         struct sock *sk = sock->sk;
 185         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 186         struct sockaddr_l2 la;
 187         int len, err = 0;
 188         bool zapped;
 189
 190         BT_DBG("sk %p", sk);
 191
 192         lock_sock(sk);
 193         zapped = sock_flag(sk, SOCK_ZAPPED);
 194         release_sock(sk);
 195
 196         if (zapped)
 197                 return -EINVAL;
 198
 199         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 200             addr->sa_family != AF_BLUETOOTH)
 201                 return -EINVAL;
 202
 203         memset(&la, 0, sizeof(la));
 204         len = min_t(unsigned int, sizeof(la), alen);
 205         memcpy(&la, addr, len);
 206
 207         if (la.l2_cid && la.l2_psm)
 208                 return -EINVAL;
 209
 210         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 211                 return -EINVAL;
 212
 213         /* Check that the socket wasn't bound to something that
 214          * conflicts with the address given to connect(). If chan->src
 215          * is BDADDR_ANY it means bind() was never used, in which case
 216          * chan->src_type and la.l2_bdaddr_type do not need to match.
 217          */
 218         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 219             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 220                 /* Old user space versions will try to incorrectly bind
 221                  * the ATT socket using BDADDR_BREDR. We need to accept
 222                  * this and fix up the source address type only when
 223                  * both the source CID and destination CID indicate
 224                  * ATT. Anything else is an invalid combination.
 225                  */
 226                 if (chan->scid != L2CAP_CID_ATT ||
 227                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 228                         return -EINVAL;
 229
 230                 /* We don't have the hdev available here to make a
 231                  * better decision on random vs public, but since all
 232                  * user space versions that exhibit this issue anyway do
 233                  * not support random local addresses assuming public
 234                  * here is good enough.
 235                  */
 236                 chan->src_type = BDADDR_LE_PUBLIC;
 237         }
 238
 239         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 240                 return -EINVAL;
 241
 242         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 243                 /* We only allow ATT user space socket */
 244                 if (la.l2_cid &&
 245                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 246                         return -EINVAL;
 247         }
 248
 249         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 250          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 251          */
 252         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 253             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 254                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 255
 256         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 257                                  &la.l2_bdaddr, la.l2_bdaddr_type,
 258                                  sk->sk_sndtimeo);
 259         if (err)
 260                 return err;
 261
 262         lock_sock(sk);
 263
 264         err = bt_sock_wait_state(sk, BT_CONNECTED,
 265                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 266
 267         release_sock(sk);
 268
 269         return err;
 270 }
 271
 272 static int l2cap_sock_listen(struct socket *sock, int backlog)
 273 {
 274         struct sock *sk = sock->sk;
 275         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 276         int err = 0;
 277
 278         BT_DBG("sk %p backlog %d", sk, backlog);
 279
 280         lock_sock(sk);
 281
 282         if (sk->sk_state != BT_BOUND) {
 283                 err = -EBADFD;
 284                 goto done;
 285         }
 286
 287         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 288                 err = -EINVAL;
 289                 goto done;
 290         }
 291
 292         switch (chan->mode) {
 293         case L2CAP_MODE_BASIC:
 294         case L2CAP_MODE_LE_FLOWCTL:
 295                 break;
 296         case L2CAP_MODE_EXT_FLOWCTL:
 297                 if (!enable_ecred) {
 298                         err = -EOPNOTSUPP;
 299                         goto done;
 300                 }
 301                 break;
 302         case L2CAP_MODE_ERTM:
 303         case L2CAP_MODE_STREAMING:
 304                 if (!disable_ertm)
 305                         break;
 306                 fallthrough;
 307         default:
 308                 err = -EOPNOTSUPP;
 309                 goto done;
 310         }
 311
 312         sk->sk_max_ack_backlog = backlog;
 313         sk->sk_ack_backlog = 0;
 314
 315         /* Listening channels need to use nested locking in order not to
 316          * cause lockdep warnings when the created child channels end up
 317          * being locked in the same thread as the parent channel.
 318          */
 319         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 320
 321         chan->state = BT_LISTEN;
 322         sk->sk_state = BT_LISTEN;
 323
 324 done:
 325         release_sock(sk);
 326         return err;
 327 }
 328
 329 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 330                              struct proto_accept_arg *arg)
 331 {
 332         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 333         struct sock *sk = sock->sk, *nsk;
 334         long timeo;
 335         int err = 0;
 336
 337         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 338
 339         timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
 340
 341         BT_DBG("sk %p timeo %ld", sk, timeo);
 342
 343         /* Wait for an incoming connection. (wake-one). */
 344         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 345         while (1) {
 346                 if (sk->sk_state != BT_LISTEN) {
 347                         err = -EBADFD;
 348                         break;
 349                 }
 350
 351                 nsk = bt_accept_dequeue(sk, newsock);
 352                 if (nsk)
 353                         break;
 354
 355                 if (!timeo) {
 356                         err = -EAGAIN;
 357                         break;
 358                 }
 359
 360                 if (signal_pending(current)) {
 361                         err = sock_intr_errno(timeo);
 362                         break;
 363                 }
 364
 365                 release_sock(sk);
 366
 367                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 368
 369                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 370         }
 371         remove_wait_queue(sk_sleep(sk), &wait);
 372
 373         if (err)
 374                 goto done;
 375
 376         newsock->state = SS_CONNECTED;
 377
 378         BT_DBG("new socket %p", nsk);
 379
 380 done:
 381         release_sock(sk);
 382         return err;
 383 }
 384
 385 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 386                               int peer)
 387 {
 388         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 389         struct sock *sk = sock->sk;
 390         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 391
 392         BT_DBG("sock %p, sk %p", sock, sk);
 393
 394         if (peer && sk->sk_state != BT_CONNECTED &&
 395             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 396             sk->sk_state != BT_CONFIG)
 397                 return -ENOTCONN;
 398
 399         memset(la, 0, sizeof(struct sockaddr_l2));
 400         addr->sa_family = AF_BLUETOOTH;
 401
 402         la->l2_psm = chan->psm;
 403
 404         if (peer) {
 405                 bacpy(&la->l2_bdaddr, &chan->dst);
 406                 la->l2_cid = cpu_to_le16(chan->dcid);
 407                 la->l2_bdaddr_type = chan->dst_type;
 408         } else {
 409                 bacpy(&la->l2_bdaddr, &chan->src);
 410                 la->l2_cid = cpu_to_le16(chan->scid);
 411                 la->l2_bdaddr_type = chan->src_type;
 412         }
 413
 414         return sizeof(struct sockaddr_l2);
 415 }
 416
 417 static int l2cap_get_mode(struct l2cap_chan *chan)
 418 {
 419         switch (chan->mode) {
 420         case L2CAP_MODE_BASIC:
 421                 return BT_MODE_BASIC;
 422         case L2CAP_MODE_ERTM:
 423                 return BT_MODE_ERTM;
 424         case L2CAP_MODE_STREAMING:
 425                 return BT_MODE_STREAMING;
 426         case L2CAP_MODE_LE_FLOWCTL:
 427                 return BT_MODE_LE_FLOWCTL;
 428         case L2CAP_MODE_EXT_FLOWCTL:
 429                 return BT_MODE_EXT_FLOWCTL;
 430         }
 431
 432         return -EINVAL;
 433 }
 434
 435 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 436                                      char __user *optval, int __user *optlen)
 437 {
 438         struct sock *sk = sock->sk;
 439         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 440         struct l2cap_options opts;
 441         struct l2cap_conninfo cinfo;
 442         int err = 0;
 443         size_t len;
 444         u32 opt;
 445
 446         BT_DBG("sk %p", sk);
 447
 448         if (get_user(len, optlen))
 449                 return -EFAULT;
 450
 451         lock_sock(sk);
 452
 453         switch (optname) {
 454         case L2CAP_OPTIONS:
 455                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 456                  * legacy ATT code depends on getsockopt for
 457                  * L2CAP_OPTIONS we need to let this pass.
 458                  */
 459                 if (bdaddr_type_is_le(chan->src_type) &&
 460                     chan->scid != L2CAP_CID_ATT) {
 461                         err = -EINVAL;
 462                         break;
 463                 }
 464
 465                 /* Only BR/EDR modes are supported here */
 466                 switch (chan->mode) {
 467                 case L2CAP_MODE_BASIC:
 468                 case L2CAP_MODE_ERTM:
 469                 case L2CAP_MODE_STREAMING:
 470                         break;
 471                 default:
 472                         err = -EINVAL;
 473                         break;
 474                 }
 475
 476                 if (err < 0)
 477                         break;
 478
 479                 memset(&opts, 0, sizeof(opts));
 480                 opts.imtu     = chan->imtu;
 481                 opts.omtu     = chan->omtu;
 482                 opts.flush_to = chan->flush_to;
 483                 opts.mode     = chan->mode;
 484                 opts.fcs      = chan->fcs;
 485                 opts.max_tx   = chan->max_tx;
 486                 opts.txwin_size = chan->tx_win;
 487
 488                 BT_DBG("mode 0x%2.2x", chan->mode);
 489
 490                 len = min(len, sizeof(opts));
 491                 if (copy_to_user(optval, (char *) &opts, len))
 492                         err = -EFAULT;
 493
 494                 break;
 495
 496         case L2CAP_LM:
 497                 switch (chan->sec_level) {
 498                 case BT_SECURITY_LOW:
 499                         opt = L2CAP_LM_AUTH;
 500                         break;
 501                 case BT_SECURITY_MEDIUM:
 502                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 503                         break;
 504                 case BT_SECURITY_HIGH:
 505                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 506                               L2CAP_LM_SECURE;
 507                         break;
 508                 case BT_SECURITY_FIPS:
 509                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 510                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 511                         break;
 512                 default:
 513                         opt = 0;
 514                         break;
 515                 }
 516
 517                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 518                         opt |= L2CAP_LM_MASTER;
 519
 520                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 521                         opt |= L2CAP_LM_RELIABLE;
 522
 523                 if (put_user(opt, (u32 __user *) optval))
 524                         err = -EFAULT;
 525
 526                 break;
 527
 528         case L2CAP_CONNINFO:
 529                 if (sk->sk_state != BT_CONNECTED &&
 530                     !(sk->sk_state == BT_CONNECT2 &&
 531                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 532                         err = -ENOTCONN;
 533                         break;
 534                 }
 535
 536                 memset(&cinfo, 0, sizeof(cinfo));
 537                 cinfo.hci_handle = chan->conn->hcon->handle;
 538                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 539
 540                 len = min(len, sizeof(cinfo));
 541                 if (copy_to_user(optval, (char *) &cinfo, len))
 542                         err = -EFAULT;
 543
 544                 break;
 545
 546         default:
 547                 err = -ENOPROTOOPT;
 548                 break;
 549         }
 550
 551         release_sock(sk);
 552         return err;
 553 }
 554
 555 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 556                                  char __user *optval, int __user *optlen)
 557 {
 558         struct sock *sk = sock->sk;
 559         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 560         struct bt_security sec;
 561         struct bt_power pwr;
 562         u32 phys;
 563         int len, mode, err = 0;
 564
 565         BT_DBG("sk %p", sk);
 566
 567         if (level == SOL_L2CAP)
 568                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 569
 570         if (level != SOL_BLUETOOTH)
 571                 return -ENOPROTOOPT;
 572
 573         if (get_user(len, optlen))
 574                 return -EFAULT;
 575
 576         lock_sock(sk);
 577
 578         switch (optname) {
 579         case BT_SECURITY:
 580                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 581                     chan->chan_type != L2CAP_CHAN_FIXED &&
 582                     chan->chan_type != L2CAP_CHAN_RAW) {
 583                         err = -EINVAL;
 584                         break;
 585                 }
 586
 587                 memset(&sec, 0, sizeof(sec));
 588                 if (chan->conn) {
 589                         sec.level = chan->conn->hcon->sec_level;
 590
 591                         if (sk->sk_state == BT_CONNECTED)
 592                                 sec.key_size = chan->conn->hcon->enc_key_size;
 593                 } else {
 594                         sec.level = chan->sec_level;
 595                 }
 596
 597                 len = min_t(unsigned int, len, sizeof(sec));
 598                 if (copy_to_user(optval, (char *) &sec, len))
 599                         err = -EFAULT;
 600
 601                 break;
 602
 603         case BT_DEFER_SETUP:
 604                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 605                         err = -EINVAL;
 606                         break;
 607                 }
 608
 609                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 610                              (u32 __user *) optval))
 611                         err = -EFAULT;
 612
 613                 break;
 614
 615         case BT_FLUSHABLE:
 616                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 617                              (u32 __user *) optval))
 618                         err = -EFAULT;
 619
 620                 break;
 621
 622         case BT_POWER:
 623                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 624                     && sk->sk_type != SOCK_RAW) {
 625                         err = -EINVAL;
 626                         break;
 627                 }
 628
 629                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 630
 631                 len = min_t(unsigned int, len, sizeof(pwr));
 632                 if (copy_to_user(optval, (char *) &pwr, len))
 633                         err = -EFAULT;
 634
 635                 break;
 636
 637         case BT_CHANNEL_POLICY:
 638                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 639                         err = -EFAULT;
 640                 break;
 641
 642         case BT_SNDMTU:
 643                 if (!bdaddr_type_is_le(chan->src_type)) {
 644                         err = -EINVAL;
 645                         break;
 646                 }
 647
 648                 if (sk->sk_state != BT_CONNECTED) {
 649                         err = -ENOTCONN;
 650                         break;
 651                 }
 652
 653                 if (put_user(chan->omtu, (u16 __user *) optval))
 654                         err = -EFAULT;
 655                 break;
 656
 657         case BT_RCVMTU:
 658                 if (!bdaddr_type_is_le(chan->src_type)) {
 659                         err = -EINVAL;
 660                         break;
 661                 }
 662
 663                 if (put_user(chan->imtu, (u16 __user *) optval))
 664                         err = -EFAULT;
 665                 break;
 666
 667         case BT_PHY:
 668                 if (sk->sk_state != BT_CONNECTED) {
 669                         err = -ENOTCONN;
 670                         break;
 671                 }
 672
 673                 phys = hci_conn_get_phy(chan->conn->hcon);
 674
 675                 if (put_user(phys, (u32 __user *) optval))
 676                         err = -EFAULT;
 677                 break;
 678
 679         case BT_MODE:
 680                 if (!enable_ecred) {
 681                         err = -ENOPROTOOPT;
 682                         break;
 683                 }
 684
 685                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 686                         err = -EINVAL;
 687                         break;
 688                 }
 689
 690                 mode = l2cap_get_mode(chan);
 691                 if (mode < 0) {
 692                         err = mode;
 693                         break;
 694                 }
 695
 696                 if (put_user(mode, (u8 __user *) optval))
 697                         err = -EFAULT;
 698                 break;
 699
 700         default:
 701                 err = -ENOPROTOOPT;
 702                 break;
 703         }
 704
 705         release_sock(sk);
 706         return err;
 707 }
 708
 709 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 710 {
 711         switch (chan->scid) {
 712         case L2CAP_CID_ATT:
 713                 if (mtu && mtu < L2CAP_LE_MIN_MTU)
 714                         return false;
 715                 break;
 716
 717         default:
 718                 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU)
 719                         return false;
 720         }
 721
 722         return true;
 723 }
 724
 725 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 726                                      sockptr_t optval, unsigned int optlen)
 727 {
 728         struct sock *sk = sock->sk;
 729         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 730         struct l2cap_options opts;
 731         int err = 0;
 732         u32 opt;
 733
 734         BT_DBG("sk %p", sk);
 735
 736         lock_sock(sk);
 737
 738         switch (optname) {
 739         case L2CAP_OPTIONS:
 740                 if (bdaddr_type_is_le(chan->src_type)) {
 741                         err = -EINVAL;
 742                         break;
 743                 }
 744
 745                 if (sk->sk_state == BT_CONNECTED) {
 746                         err = -EINVAL;
 747                         break;
 748                 }
 749
 750                 opts.imtu     = chan->imtu;
 751                 opts.omtu     = chan->omtu;
 752                 opts.flush_to = chan->flush_to;
 753                 opts.mode     = chan->mode;
 754                 opts.fcs      = chan->fcs;
 755                 opts.max_tx   = chan->max_tx;
 756                 opts.txwin_size = chan->tx_win;
 757
 758                 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval,
 759                                              optlen);
 760                 if (err)
 761                         break;
 762
 763                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 764                         err = -EINVAL;
 765                         break;
 766                 }
 767
 768                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 769                         err = -EINVAL;
 770                         break;
 771                 }
 772
 773                 /* Only BR/EDR modes are supported here */
 774                 switch (opts.mode) {
 775                 case L2CAP_MODE_BASIC:
 776                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 777                         break;
 778                 case L2CAP_MODE_ERTM:
 779                 case L2CAP_MODE_STREAMING:
 780                         if (!disable_ertm)
 781                                 break;
 782                         fallthrough;
 783                 default:
 784                         err = -EINVAL;
 785                         break;
 786                 }
 787
 788                 if (err < 0)
 789                         break;
 790
 791                 chan->mode = opts.mode;
 792
 793                 BT_DBG("mode 0x%2.2x", chan->mode);
 794
 795                 chan->imtu = opts.imtu;
 796                 chan->omtu = opts.omtu;
 797                 chan->fcs  = opts.fcs;
 798                 chan->max_tx = opts.max_tx;
 799                 chan->tx_win = opts.txwin_size;
 800                 chan->flush_to = opts.flush_to;
 801                 break;
 802
 803         case L2CAP_LM:
 804                 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 805                 if (err)
 806                         break;
 807
 808                 if (opt & L2CAP_LM_FIPS) {
 809                         err = -EINVAL;
 810                         break;
 811                 }
 812
 813                 if (opt & L2CAP_LM_AUTH)
 814                         chan->sec_level = BT_SECURITY_LOW;
 815                 if (opt & L2CAP_LM_ENCRYPT)
 816                         chan->sec_level = BT_SECURITY_MEDIUM;
 817                 if (opt & L2CAP_LM_SECURE)
 818                         chan->sec_level = BT_SECURITY_HIGH;
 819
 820                 if (opt & L2CAP_LM_MASTER)
 821                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 822                 else
 823                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 824
 825                 if (opt & L2CAP_LM_RELIABLE)
 826                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 827                 else
 828                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 829                 break;
 830
 831         default:
 832                 err = -ENOPROTOOPT;
 833                 break;
 834         }
 835
 836         release_sock(sk);
 837         return err;
 838 }
 839
 840 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 841 {
 842         switch (mode) {
 843         case BT_MODE_BASIC:
 844                 if (bdaddr_type_is_le(chan->src_type))
 845                         return -EINVAL;
 846                 mode = L2CAP_MODE_BASIC;
 847                 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 848                 break;
 849         case BT_MODE_ERTM:
 850                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 851                         return -EINVAL;
 852                 mode = L2CAP_MODE_ERTM;
 853                 break;
 854         case BT_MODE_STREAMING:
 855                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 856                         return -EINVAL;
 857                 mode = L2CAP_MODE_STREAMING;
 858                 break;
 859         case BT_MODE_LE_FLOWCTL:
 860                 if (!bdaddr_type_is_le(chan->src_type))
 861                         return -EINVAL;
 862                 mode = L2CAP_MODE_LE_FLOWCTL;
 863                 break;
 864         case BT_MODE_EXT_FLOWCTL:
 865                 /* TODO: Add support for ECRED PDUs to BR/EDR */
 866                 if (!bdaddr_type_is_le(chan->src_type))
 867                         return -EINVAL;
 868                 mode = L2CAP_MODE_EXT_FLOWCTL;
 869                 break;
 870         default:
 871                 return -EINVAL;
 872         }
 873
 874         chan->mode = mode;
 875
 876         return 0;
 877 }
 878
 879 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 880                                  sockptr_t optval, unsigned int optlen)
 881 {
 882         struct sock *sk = sock->sk;
 883         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 884         struct bt_security sec;
 885         struct bt_power pwr;
 886         struct l2cap_conn *conn;
 887         int err = 0;
 888         u32 opt;
 889         u16 mtu;
 890         u8 mode;
 891
 892         BT_DBG("sk %p", sk);
 893
 894         if (level == SOL_L2CAP)
 895                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 896
 897         if (level != SOL_BLUETOOTH)
 898                 return -ENOPROTOOPT;
 899
 900         lock_sock(sk);
 901
 902         switch (optname) {
 903         case BT_SECURITY:
 904                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 905                     chan->chan_type != L2CAP_CHAN_FIXED &&
 906                     chan->chan_type != L2CAP_CHAN_RAW) {
 907                         err = -EINVAL;
 908                         break;
 909                 }
 910
 911                 sec.level = BT_SECURITY_LOW;
 912
 913                 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
 914                 if (err)
 915                         break;
 916
 917                 if (sec.level < BT_SECURITY_LOW ||
 918                     sec.level > BT_SECURITY_FIPS) {
 919                         err = -EINVAL;
 920                         break;
 921                 }
 922
 923                 chan->sec_level = sec.level;
 924
 925                 if (!chan->conn)
 926                         break;
 927
 928                 conn = chan->conn;
 929
 930                 /* change security for LE channels */
 931                 if (chan->scid == L2CAP_CID_ATT) {
 932                         if (smp_conn_security(conn->hcon, sec.level)) {
 933                                 err = -EINVAL;
 934                                 break;
 935                         }
 936
 937                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 938                         sk->sk_state = BT_CONFIG;
 939                         chan->state = BT_CONFIG;
 940
 941                 /* or for ACL link */
 942                 } else if ((sk->sk_state == BT_CONNECT2 &&
 943                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 944                            sk->sk_state == BT_CONNECTED) {
 945                         if (!l2cap_chan_check_security(chan, true))
 946                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 947                         else
 948                                 sk->sk_state_change(sk);
 949                 } else {
 950                         err = -EINVAL;
 951                 }
 952                 break;
 953
 954         case BT_DEFER_SETUP:
 955                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 956                         err = -EINVAL;
 957                         break;
 958                 }
 959
 960                 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 961                 if (err)
 962                         break;
 963
 964                 if (opt) {
 965                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 966                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 967                 } else {
 968                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 969                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 970                 }
 971                 break;
 972
 973         case BT_FLUSHABLE:
 974                 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 975                 if (err)
 976                         break;
 977
 978                 if (opt > BT_FLUSHABLE_ON) {
 979                         err = -EINVAL;
 980                         break;
 981                 }
 982
 983                 if (opt == BT_FLUSHABLE_OFF) {
 984                         conn = chan->conn;
 985                         /* proceed further only when we have l2cap_conn and
 986                            No Flush support in the LM */
 987                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 988                                 err = -EINVAL;
 989                                 break;
 990                         }
 991                 }
 992
 993                 if (opt)
 994                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 995                 else
 996                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 997                 break;
 998
 999         case BT_POWER:
1000                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1001                     chan->chan_type != L2CAP_CHAN_RAW) {
1002                         err = -EINVAL;
1003                         break;
1004                 }
1005
1006                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1007
1008                 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1009                 if (err)
1010                         break;
1011
1012                 if (pwr.force_active)
1013                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1014                 else
1015                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1016                 break;
1017
1018         case BT_CHANNEL_POLICY:
1019                 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1020                 if (err)
1021                         break;
1022
1023                 err = -EOPNOTSUPP;
1024                 break;
1025
1026         case BT_SNDMTU:
1027                 if (!bdaddr_type_is_le(chan->src_type)) {
1028                         err = -EINVAL;
1029                         break;
1030                 }
1031
1032                 /* Setting is not supported as it's the remote side that
1033                  * decides this.
1034                  */
1035                 err = -EPERM;
1036                 break;
1037
1038         case BT_RCVMTU:
1039                 if (!bdaddr_type_is_le(chan->src_type)) {
1040                         err = -EINVAL;
1041                         break;
1042                 }
1043
1044                 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1045                     sk->sk_state == BT_CONNECTED) {
1046                         err = -EISCONN;
1047                         break;
1048                 }
1049
1050                 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1051                 if (err)
1052                         break;
1053
1054                 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1055                     sk->sk_state == BT_CONNECTED)
1056                         err = l2cap_chan_reconfigure(chan, mtu);
1057                 else
1058                         chan->imtu = mtu;
1059
1060                 break;
1061
1062         case BT_MODE:
1063                 if (!enable_ecred) {
1064                         err = -ENOPROTOOPT;
1065                         break;
1066                 }
1067
1068                 BT_DBG("sk->sk_state %u", sk->sk_state);
1069
1070                 if (sk->sk_state != BT_BOUND) {
1071                         err = -EINVAL;
1072                         break;
1073                 }
1074
1075                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1076                         err = -EINVAL;
1077                         break;
1078                 }
1079
1080                 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval,
1081                                              optlen);
1082                 if (err)
1083                         break;
1084
1085                 BT_DBG("mode %u", mode);
1086
1087                 err = l2cap_set_mode(chan, mode);
1088                 if (err)
1089                         break;
1090
1091                 BT_DBG("mode 0x%2.2x", chan->mode);
1092
1093                 break;
1094
1095         default:
1096                 err = -ENOPROTOOPT;
1097                 break;
1098         }
1099
1100         release_sock(sk);
1101         return err;
1102 }
1103
1104 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1105                               size_t len)
1106 {
1107         struct sock *sk = sock->sk;
1108         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1109         int err;
1110
1111         BT_DBG("sock %p, sk %p", sock, sk);
1112
1113         err = sock_error(sk);
1114         if (err)
1115                 return err;
1116
1117         if (msg->msg_flags & MSG_OOB)
1118                 return -EOPNOTSUPP;
1119
1120         if (sk->sk_state != BT_CONNECTED)
1121                 return -ENOTCONN;
1122
1123         lock_sock(sk);
1124         err = bt_sock_wait_ready(sk, msg->msg_flags);
1125         release_sock(sk);
1126         if (err)
1127                 return err;
1128
1129         l2cap_chan_lock(chan);
1130         err = l2cap_chan_send(chan, msg, len);
1131         l2cap_chan_unlock(chan);
1132
1133         return err;
1134 }
1135
1136 static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
1137 {
1138         struct sock *sk = chan->data;
1139         ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc);
1140         int expected_skbs, skb_overhead;
1141
1142         if (avail <= 0) {
1143                 l2cap_chan_rx_avail(chan, 0);
1144                 return;
1145         }
1146
1147         if (!chan->mps) {
1148                 l2cap_chan_rx_avail(chan, -1);
1149                 return;
1150         }
1151
1152         /* Correct available memory by estimated sk_buff overhead.
1153          * This is significant due to small transfer sizes. However, accept
1154          * at least one full packet if receive space is non-zero.
1155          */
1156         expected_skbs = DIV_ROUND_UP(avail, chan->mps);
1157         skb_overhead = expected_skbs * sizeof(struct sk_buff);
1158         if (skb_overhead < avail)
1159                 l2cap_chan_rx_avail(chan, avail - skb_overhead);
1160         else
1161                 l2cap_chan_rx_avail(chan, -1);
1162 }
1163
1164 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1165                               size_t len, int flags)
1166 {
1167         struct sock *sk = sock->sk;
1168         struct l2cap_pinfo *pi = l2cap_pi(sk);
1169         int err;
1170
1171         lock_sock(sk);
1172
1173         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1174                                                     &bt_sk(sk)->flags)) {
1175                 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1176                         sk->sk_state = BT_CONNECTED;
1177                         pi->chan->state = BT_CONNECTED;
1178                         __l2cap_ecred_conn_rsp_defer(pi->chan);
1179                 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1180                         sk->sk_state = BT_CONNECTED;
1181                         pi->chan->state = BT_CONNECTED;
1182                         __l2cap_le_connect_rsp_defer(pi->chan);
1183                 } else {
1184                         sk->sk_state = BT_CONFIG;
1185                         pi->chan->state = BT_CONFIG;
1186                         __l2cap_connect_rsp_defer(pi->chan);
1187                 }
1188
1189                 err = 0;
1190                 goto done;
1191         }
1192
1193         release_sock(sk);
1194
1195         if (sock->type == SOCK_STREAM)
1196                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1197         else
1198                 err = bt_sock_recvmsg(sock, msg, len, flags);
1199
1200         if (pi->chan->mode != L2CAP_MODE_ERTM &&
1201             pi->chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1202             pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL)
1203                 return err;
1204
1205         lock_sock(sk);
1206
1207         l2cap_publish_rx_avail(pi->chan);
1208
1209         /* Attempt to put pending rx data in the socket buffer */
1210         while (!list_empty(&pi->rx_busy)) {
1211                 struct l2cap_rx_busy *rx_busy =
1212                         list_first_entry(&pi->rx_busy,
1213                                          struct l2cap_rx_busy,
1214                                          list);
1215                 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0)
1216                         goto done;
1217                 list_del(&rx_busy->list);
1218                 kfree(rx_busy);
1219         }
1220
1221         /* Restore data flow when half of the receive buffer is
1222          * available.  This avoids resending large numbers of
1223          * frames.
1224          */
1225         if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) &&
1226             atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1227                 l2cap_chan_busy(pi->chan, 0);
1228
1229 done:
1230         release_sock(sk);
1231         return err;
1232 }
1233
1234 /* Kill socket (only if zapped and orphan)
1235  * Must be called on unlocked socket, with l2cap channel lock.
1236  */
1237 static void l2cap_sock_kill(struct sock *sk)
1238 {
1239         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1240                 return;
1241
1242         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1243
1244         /* Sock is dead, so set chan data to NULL, avoid other task use invalid
1245          * sock pointer.
1246          */
1247         l2cap_pi(sk)->chan->data = NULL;
1248         /* Kill poor orphan */
1249
1250         l2cap_chan_put(l2cap_pi(sk)->chan);
1251         sock_set_flag(sk, SOCK_DEAD);
1252         sock_put(sk);
1253 }
1254
1255 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1256 {
1257         DECLARE_WAITQUEUE(wait, current);
1258         int err = 0;
1259         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1260         /* Timeout to prevent infinite loop */
1261         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1262
1263         add_wait_queue(sk_sleep(sk), &wait);
1264         set_current_state(TASK_INTERRUPTIBLE);
1265         do {
1266                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1267                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1268                        jiffies_to_msecs(timeout - jiffies));
1269
1270                 if (!timeo)
1271                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1272
1273                 if (signal_pending(current)) {
1274                         err = sock_intr_errno(timeo);
1275                         break;
1276                 }
1277
1278                 release_sock(sk);
1279                 timeo = schedule_timeout(timeo);
1280                 lock_sock(sk);
1281                 set_current_state(TASK_INTERRUPTIBLE);
1282
1283                 err = sock_error(sk);
1284                 if (err)
1285                         break;
1286
1287                 if (time_after(jiffies, timeout)) {
1288                         err = -ENOLINK;
1289                         break;
1290                 }
1291
1292         } while (chan->unacked_frames > 0 &&
1293                  chan->state == BT_CONNECTED);
1294
1295         set_current_state(TASK_RUNNING);
1296         remove_wait_queue(sk_sleep(sk), &wait);
1297         return err;
1298 }
1299
1300 static int l2cap_sock_shutdown(struct socket *sock, int how)
1301 {
1302         struct sock *sk = sock->sk;
1303         struct l2cap_chan *chan;
1304         struct l2cap_conn *conn;
1305         int err = 0;
1306
1307         BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1308
1309         /* 'how' parameter is mapped to sk_shutdown as follows:
1310          * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1311          * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1312          * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1313          */
1314         how++;
1315
1316         if (!sk)
1317                 return 0;
1318
1319         lock_sock(sk);
1320
1321         if ((sk->sk_shutdown & how) == how)
1322                 goto shutdown_already;
1323
1324         BT_DBG("Handling sock shutdown");
1325
1326         /* prevent sk structure from being freed whilst unlocked */
1327         sock_hold(sk);
1328
1329         /* prevent chan structure from being freed whilst unlocked */
1330         chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
1331         if (!chan)
1332                 goto shutdown_already;
1333
1334         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1335
1336         if (chan->mode == L2CAP_MODE_ERTM &&
1337             chan->unacked_frames > 0 &&
1338             chan->state == BT_CONNECTED) {
1339                 err = __l2cap_wait_ack(sk, chan);
1340
1341                 /* After waiting for ACKs, check whether shutdown
1342                  * has already been actioned to close the L2CAP
1343                  * link such as by l2cap_disconnection_req().
1344                  */
1345                 if ((sk->sk_shutdown & how) == how)
1346                         goto shutdown_matched;
1347         }
1348
1349         /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1350          * is already set
1351          */
1352         if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1353                 sk->sk_shutdown |= RCV_SHUTDOWN;
1354                 if ((sk->sk_shutdown & how) == how)
1355                         goto shutdown_matched;
1356         }
1357
1358         sk->sk_shutdown |= SEND_SHUTDOWN;
1359         release_sock(sk);
1360
1361         l2cap_chan_lock(chan);
1362         /* prevent conn structure from being freed */
1363         conn = l2cap_conn_hold_unless_zero(chan->conn);
1364         l2cap_chan_unlock(chan);
1365
1366         if (conn)
1367                 /* mutex lock must be taken before l2cap_chan_lock() */
1368                 mutex_lock(&conn->lock);
1369
1370         l2cap_chan_lock(chan);
1371         l2cap_chan_close(chan, 0);
1372         l2cap_chan_unlock(chan);
1373
1374         if (conn) {
1375                 mutex_unlock(&conn->lock);
1376                 l2cap_conn_put(conn);
1377         }
1378
1379         lock_sock(sk);
1380
1381         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1382             !(current->flags & PF_EXITING))
1383                 err = bt_sock_wait_state(sk, BT_CLOSED,
1384                                          sk->sk_lingertime);
1385
1386 shutdown_matched:
1387         l2cap_chan_put(chan);
1388         sock_put(sk);
1389
1390 shutdown_already:
1391         if (!err && sk->sk_err)
1392                 err = -sk->sk_err;
1393
1394         release_sock(sk);
1395
1396         BT_DBG("Sock shutdown complete err: %d", err);
1397
1398         return err;
1399 }
1400
1401 static int l2cap_sock_release(struct socket *sock)
1402 {
1403         struct sock *sk = sock->sk;
1404         int err;
1405         struct l2cap_chan *chan;
1406
1407         BT_DBG("sock %p, sk %p", sock, sk);
1408
1409         if (!sk)
1410                 return 0;
1411
1412         l2cap_sock_cleanup_listen(sk);
1413         bt_sock_unlink(&l2cap_sk_list, sk);
1414
1415         err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1416         chan = l2cap_pi(sk)->chan;
1417
1418         l2cap_chan_hold(chan);
1419         l2cap_chan_lock(chan);
1420
1421         sock_orphan(sk);
1422         l2cap_sock_kill(sk);
1423
1424         l2cap_chan_unlock(chan);
1425         l2cap_chan_put(chan);
1426
1427         return err;
1428 }
1429
1430 static void l2cap_sock_cleanup_listen(struct sock *parent)
1431 {
1432         struct sock *sk;
1433
1434         BT_DBG("parent %p state %s", parent,
1435                state_to_string(parent->sk_state));
1436
1437         /* Close not yet accepted channels */
1438         while ((sk = bt_accept_dequeue(parent, NULL))) {
1439                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1440
1441                 BT_DBG("child chan %p state %s", chan,
1442                        state_to_string(chan->state));
1443
1444                 l2cap_chan_hold(chan);
1445                 l2cap_chan_lock(chan);
1446
1447                 __clear_chan_timer(chan);
1448                 l2cap_chan_close(chan, ECONNRESET);
1449                 l2cap_sock_kill(sk);
1450
1451                 l2cap_chan_unlock(chan);
1452                 l2cap_chan_put(chan);
1453         }
1454 }
1455
1456 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1457 {
1458         struct sock *sk, *parent = chan->data;
1459
1460         lock_sock(parent);
1461
1462         /* Check for backlog size */
1463         if (sk_acceptq_is_full(parent)) {
1464                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1465                 release_sock(parent);
1466                 return NULL;
1467         }
1468
1469         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1470                               GFP_ATOMIC, 0);
1471         if (!sk) {
1472                 release_sock(parent);
1473                 return NULL;
1474         }
1475
1476         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1477
1478         l2cap_sock_init(sk, parent);
1479
1480         bt_accept_enqueue(parent, sk, false);
1481
1482         release_sock(parent);
1483
1484         return l2cap_pi(sk)->chan;
1485 }
1486
1487 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1488 {
1489         struct sock *sk;
1490         struct l2cap_pinfo *pi;
1491         int err;
1492
1493         sk = chan->data;
1494         if (!sk)
1495                 return -ENXIO;
1496
1497         pi = l2cap_pi(sk);
1498         lock_sock(sk);
1499         if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
1500                 err = -ENOMEM;
1501                 goto done;
1502         }
1503
1504         if (chan->mode != L2CAP_MODE_ERTM &&
1505             chan->mode != L2CAP_MODE_STREAMING &&
1506             chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1507             chan->mode != L2CAP_MODE_EXT_FLOWCTL) {
1508                 /* Even if no filter is attached, we could potentially
1509                  * get errors from security modules, etc.
1510                  */
1511                 err = sk_filter(sk, skb);
1512                 if (err)
1513                         goto done;
1514         }
1515
1516         err = __sock_queue_rcv_skb(sk, skb);
1517
1518         l2cap_publish_rx_avail(chan);
1519
1520         /* For ERTM and LE, handle a skb that doesn't fit into the recv
1521          * buffer.  This is important to do because the data frames
1522          * have already been acked, so the skb cannot be discarded.
1523          *
1524          * Notify the l2cap core that the buffer is full, so the
1525          * LOCAL_BUSY state is entered and no more frames are
1526          * acked and reassembled until there is buffer space
1527          * available.
1528          */
1529         if (err < 0 &&
1530             (chan->mode == L2CAP_MODE_ERTM ||
1531              chan->mode == L2CAP_MODE_LE_FLOWCTL ||
1532              chan->mode == L2CAP_MODE_EXT_FLOWCTL)) {
1533                 struct l2cap_rx_busy *rx_busy =
1534                         kmalloc(sizeof(*rx_busy), GFP_KERNEL);
1535                 if (!rx_busy) {
1536                         err = -ENOMEM;
1537                         goto done;
1538                 }
1539                 rx_busy->skb = skb;
1540                 list_add_tail(&rx_busy->list, &pi->rx_busy);
1541                 l2cap_chan_busy(chan, 1);
1542                 err = 0;
1543         }
1544
1545 done:
1546         release_sock(sk);
1547
1548         return err;
1549 }
1550
1551 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1552 {
1553         struct sock *sk = chan->data;
1554
1555         if (!sk)
1556                 return;
1557
1558         l2cap_sock_kill(sk);
1559 }
1560
1561 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1562 {
1563         struct sock *sk = chan->data;
1564         struct sock *parent;
1565
1566         if (!sk)
1567                 return;
1568
1569         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1570
1571         /* This callback can be called both for server (BT_LISTEN)
1572          * sockets as well as "normal" ones. To avoid lockdep warnings
1573          * with child socket locking (through l2cap_sock_cleanup_listen)
1574          * we need separation into separate nesting levels. The simplest
1575          * way to accomplish this is to inherit the nesting level used
1576          * for the channel.
1577          */
1578         lock_sock_nested(sk, atomic_read(&chan->nesting));
1579
1580         parent = bt_sk(sk)->parent;
1581
1582         switch (chan->state) {
1583         case BT_OPEN:
1584         case BT_BOUND:
1585         case BT_CLOSED:
1586                 break;
1587         case BT_LISTEN:
1588                 l2cap_sock_cleanup_listen(sk);
1589                 sk->sk_state = BT_CLOSED;
1590                 chan->state = BT_CLOSED;
1591
1592                 break;
1593         default:
1594                 sk->sk_state = BT_CLOSED;
1595                 chan->state = BT_CLOSED;
1596
1597                 sk->sk_err = err;
1598
1599                 if (parent) {
1600                         bt_accept_unlink(sk);
1601                         parent->sk_data_ready(parent);
1602                 } else {
1603                         sk->sk_state_change(sk);
1604                 }
1605
1606                 break;
1607         }
1608         release_sock(sk);
1609
1610         /* Only zap after cleanup to avoid use after free race */
1611         sock_set_flag(sk, SOCK_ZAPPED);
1612
1613 }
1614
1615 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1616                                        int err)
1617 {
1618         struct sock *sk = chan->data;
1619
1620         sk->sk_state = state;
1621
1622         if (err)
1623                 sk->sk_err = err;
1624 }
1625
1626 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1627                                                unsigned long hdr_len,
1628                                                unsigned long len, int nb)
1629 {
1630         struct sock *sk = chan->data;
1631         struct sk_buff *skb;
1632         int err;
1633
1634         l2cap_chan_unlock(chan);
1635         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1636         l2cap_chan_lock(chan);
1637
1638         if (!skb)
1639                 return ERR_PTR(err);
1640
1641         /* Channel lock is released before requesting new skb and then
1642          * reacquired thus we need to recheck channel state.
1643          */
1644         if (chan->state != BT_CONNECTED) {
1645                 kfree_skb(skb);
1646                 return ERR_PTR(-ENOTCONN);
1647         }
1648
1649         skb->priority = READ_ONCE(sk->sk_priority);
1650
1651         bt_cb(skb)->l2cap.chan = chan;
1652
1653         return skb;
1654 }
1655
1656 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1657 {
1658         struct sock *sk = chan->data;
1659         struct sock *parent;
1660
1661         lock_sock(sk);
1662
1663         parent = bt_sk(sk)->parent;
1664
1665         BT_DBG("sk %p, parent %p", sk, parent);
1666
1667         sk->sk_state = BT_CONNECTED;
1668         sk->sk_state_change(sk);
1669
1670         if (parent)
1671                 parent->sk_data_ready(parent);
1672
1673         release_sock(sk);
1674 }
1675
1676 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1677 {
1678         struct sock *parent, *sk = chan->data;
1679
1680         lock_sock(sk);
1681
1682         parent = bt_sk(sk)->parent;
1683         if (parent)
1684                 parent->sk_data_ready(parent);
1685
1686         release_sock(sk);
1687 }
1688
1689 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1690 {
1691         struct sock *sk = chan->data;
1692
1693         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1694                 sk->sk_state = BT_CONNECTED;
1695                 chan->state = BT_CONNECTED;
1696         }
1697
1698         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1699         sk->sk_state_change(sk);
1700 }
1701
1702 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1703 {
1704         struct sock *sk = chan->data;
1705
1706         lock_sock(sk);
1707         sk->sk_shutdown = SHUTDOWN_MASK;
1708         release_sock(sk);
1709 }
1710
1711 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1712 {
1713         struct sock *sk = chan->data;
1714
1715         return sk->sk_sndtimeo;
1716 }
1717
1718 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1719 {
1720         struct sock *sk = chan->data;
1721
1722         return sk->sk_peer_pid;
1723 }
1724
1725 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1726 {
1727         struct sock *sk = chan->data;
1728
1729         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1730         sk->sk_state_change(sk);
1731 }
1732
1733 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1734 {
1735         struct sock *sk = chan->data;
1736
1737         switch (chan->mode) {
1738         case L2CAP_MODE_ERTM:
1739         case L2CAP_MODE_STREAMING:
1740                 return sk_filter(sk, skb);
1741         }
1742
1743         return 0;
1744 }
1745
1746 static const struct l2cap_ops l2cap_chan_ops = {
1747         .name                   = "L2CAP Socket Interface",
1748         .new_connection         = l2cap_sock_new_connection_cb,
1749         .recv                   = l2cap_sock_recv_cb,
1750         .close                  = l2cap_sock_close_cb,
1751         .teardown               = l2cap_sock_teardown_cb,
1752         .state_change           = l2cap_sock_state_change_cb,
1753         .ready                  = l2cap_sock_ready_cb,
1754         .defer                  = l2cap_sock_defer_cb,
1755         .resume                 = l2cap_sock_resume_cb,
1756         .suspend                = l2cap_sock_suspend_cb,
1757         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1758         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1759         .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
1760         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1761         .filter                 = l2cap_sock_filter,
1762 };
1763
1764 static void l2cap_sock_destruct(struct sock *sk)
1765 {
1766         struct l2cap_rx_busy *rx_busy, *next;
1767
1768         BT_DBG("sk %p", sk);
1769
1770         if (l2cap_pi(sk)->chan) {
1771                 l2cap_pi(sk)->chan->data = NULL;
1772                 l2cap_chan_put(l2cap_pi(sk)->chan);
1773         }
1774
1775         list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) {
1776                 kfree_skb(rx_busy->skb);
1777                 list_del(&rx_busy->list);
1778                 kfree(rx_busy);
1779         }
1780
1781         skb_queue_purge(&sk->sk_receive_queue);
1782         skb_queue_purge(&sk->sk_write_queue);
1783 }
1784
1785 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1786                                int *msg_namelen)
1787 {
1788         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1789
1790         memset(la, 0, sizeof(struct sockaddr_l2));
1791         la->l2_family = AF_BLUETOOTH;
1792         la->l2_psm = bt_cb(skb)->l2cap.psm;
1793         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1794
1795         *msg_namelen = sizeof(struct sockaddr_l2);
1796 }
1797
1798 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1799 {
1800         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1801
1802         BT_DBG("sk %p", sk);
1803
1804         if (parent) {
1805                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1806
1807                 sk->sk_type = parent->sk_type;
1808                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1809
1810                 chan->chan_type = pchan->chan_type;
1811                 chan->imtu = pchan->imtu;
1812                 chan->omtu = pchan->omtu;
1813                 chan->conf_state = pchan->conf_state;
1814                 chan->mode = pchan->mode;
1815                 chan->fcs  = pchan->fcs;
1816                 chan->max_tx = pchan->max_tx;
1817                 chan->tx_win = pchan->tx_win;
1818                 chan->tx_win_max = pchan->tx_win_max;
1819                 chan->sec_level = pchan->sec_level;
1820                 chan->flags = pchan->flags;
1821                 chan->tx_credits = pchan->tx_credits;
1822                 chan->rx_credits = pchan->rx_credits;
1823
1824                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1825                         chan->scid = pchan->scid;
1826                         chan->dcid = pchan->scid;
1827                 }
1828
1829                 security_sk_clone(parent, sk);
1830         } else {
1831                 switch (sk->sk_type) {
1832                 case SOCK_RAW:
1833                         chan->chan_type = L2CAP_CHAN_RAW;
1834                         break;
1835                 case SOCK_DGRAM:
1836                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1837                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1838                         break;
1839                 case SOCK_SEQPACKET:
1840                 case SOCK_STREAM:
1841                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1842                         break;
1843                 }
1844
1845                 chan->imtu = L2CAP_DEFAULT_MTU;
1846                 chan->omtu = 0;
1847                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1848                         chan->mode = L2CAP_MODE_ERTM;
1849                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1850                 } else {
1851                         chan->mode = L2CAP_MODE_BASIC;
1852                 }
1853
1854                 l2cap_chan_set_defaults(chan);
1855         }
1856
1857         /* Default config options */
1858         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1859
1860         chan->data = sk;
1861         chan->ops = &l2cap_chan_ops;
1862
1863         l2cap_publish_rx_avail(chan);
1864 }
1865
1866 static struct proto l2cap_proto = {
1867         .name           = "L2CAP",
1868         .owner          = THIS_MODULE,
1869         .obj_size       = sizeof(struct l2cap_pinfo)
1870 };
1871
1872 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1873                                      int proto, gfp_t prio, int kern)
1874 {
1875         struct sock *sk;
1876         struct l2cap_chan *chan;
1877
1878         sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
1879         if (!sk)
1880                 return NULL;
1881
1882         sk->sk_destruct = l2cap_sock_destruct;
1883         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1884
1885         INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy);
1886
1887         chan = l2cap_chan_create();
1888         if (!chan) {
1889                 sk_free(sk);
1890                 if (sock)
1891                         sock->sk = NULL;
1892                 return NULL;
1893         }
1894
1895         l2cap_chan_hold(chan);
1896
1897         l2cap_pi(sk)->chan = chan;
1898
1899         return sk;
1900 }
1901
1902 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1903                              int kern)
1904 {
1905         struct sock *sk;
1906
1907         BT_DBG("sock %p", sock);
1908
1909         sock->state = SS_UNCONNECTED;
1910
1911         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1912             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1913                 return -ESOCKTNOSUPPORT;
1914
1915         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1916                 return -EPERM;
1917
1918         sock->ops = &l2cap_sock_ops;
1919
1920         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1921         if (!sk)
1922                 return -ENOMEM;
1923
1924         l2cap_sock_init(sk, NULL);
1925         bt_sock_link(&l2cap_sk_list, sk);
1926         return 0;
1927 }
1928
1929 static const struct proto_ops l2cap_sock_ops = {
1930         .family         = PF_BLUETOOTH,
1931         .owner          = THIS_MODULE,
1932         .release        = l2cap_sock_release,
1933         .bind           = l2cap_sock_bind,
1934         .connect        = l2cap_sock_connect,
1935         .listen         = l2cap_sock_listen,
1936         .accept         = l2cap_sock_accept,
1937         .getname        = l2cap_sock_getname,
1938         .sendmsg        = l2cap_sock_sendmsg,
1939         .recvmsg        = l2cap_sock_recvmsg,
1940         .poll           = bt_sock_poll,
1941         .ioctl          = bt_sock_ioctl,
1942         .gettstamp      = sock_gettstamp,
1943         .mmap           = sock_no_mmap,
1944         .socketpair     = sock_no_socketpair,
1945         .shutdown       = l2cap_sock_shutdown,
1946         .setsockopt     = l2cap_sock_setsockopt,
1947         .getsockopt     = l2cap_sock_getsockopt
1948 };
1949
1950 static const struct net_proto_family l2cap_sock_family_ops = {
1951         .family = PF_BLUETOOTH,
1952         .owner  = THIS_MODULE,
1953         .create = l2cap_sock_create,
1954 };
1955
1956 int __init l2cap_init_sockets(void)
1957 {
1958         int err;
1959
1960         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1961
1962         err = proto_register(&l2cap_proto, 0);
1963         if (err < 0)
1964                 return err;
1965
1966         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1967         if (err < 0) {
1968                 BT_ERR("L2CAP socket registration failed");
1969                 goto error;
1970         }
1971
1972         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1973                              NULL);
1974         if (err < 0) {
1975                 BT_ERR("Failed to create L2CAP proc file");
1976                 bt_sock_unregister(BTPROTO_L2CAP);
1977                 goto error;
1978         }
1979
1980         BT_INFO("L2CAP socket layer initialized");
1981
1982         return 0;
1983
1984 error:
1985         proto_unregister(&l2cap_proto);
1986         return err;
1987 }
1988
1989 void l2cap_cleanup_sockets(void)
1990 {
1991         bt_procfs_cleanup(&init_net, "l2cap");
1992         bt_sock_unregister(BTPROTO_L2CAP);
1993         proto_unregister(&l2cap_proto);
1994 }