net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/filter.h>
  33 #include <linux/sched/signal.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38
  39 #include "smp.h"
  40
  41 static struct bt_sock_list l2cap_sk_list = {
  42         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43 };
  44
  45 static const struct proto_ops l2cap_sock_ops;
  46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48                                      int proto, gfp_t prio, int kern);
  49 static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51 bool l2cap_is_socket(struct socket *sock)
  52 {
  53         return sock && sock->ops == &l2cap_sock_ops;
  54 }
  55 EXPORT_SYMBOL(l2cap_is_socket);
  56
  57 static int l2cap_validate_bredr_psm(u16 psm)
  58 {
  59         /* PSM must be odd and lsb of upper byte must be 0 */
  60         if ((psm & 0x0101) != 0x0001)
  61                 return -EINVAL;
  62
  63         /* Restrict usage of well-known PSMs */
  64         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65                 return -EACCES;
  66
  67         return 0;
  68 }
  69
  70 static int l2cap_validate_le_psm(u16 psm)
  71 {
  72         /* Valid LE_PSM ranges are defined only until 0x00ff */
  73         if (psm > L2CAP_PSM_LE_DYN_END)
  74                 return -EINVAL;
  75
  76         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78                 return -EACCES;
  79
  80         return 0;
  81 }
  82
  83 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  84 {
  85         struct sock *sk = sock->sk;
  86         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87         struct sockaddr_l2 la;
  88         int len, err = 0;
  89
  90         BT_DBG("sk %p", sk);
  91
  92         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93             addr->sa_family != AF_BLUETOOTH)
  94                 return -EINVAL;
  95
  96         memset(&la, 0, sizeof(la));
  97         len = min_t(unsigned int, sizeof(la), alen);
  98         memcpy(&la, addr, len);
  99
 100         if (la.l2_cid && la.l2_psm)
 101                 return -EINVAL;
 102
 103         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104                 return -EINVAL;
 105
 106         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107                 /* We only allow ATT user space socket */
 108                 if (la.l2_cid &&
 109                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110                         return -EINVAL;
 111         }
 112
 113         lock_sock(sk);
 114
 115         if (sk->sk_state != BT_OPEN) {
 116                 err = -EBADFD;
 117                 goto done;
 118         }
 119
 120         if (la.l2_psm) {
 121                 __u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 124                         err = l2cap_validate_bredr_psm(psm);
 125                 else
 126                         err = l2cap_validate_le_psm(psm);
 127
 128                 if (err)
 129                         goto done;
 130         }
 131
 132         bacpy(&chan->src, &la.l2_bdaddr);
 133         chan->src_type = la.l2_bdaddr_type;
 134
 135         if (la.l2_cid)
 136                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137         else
 138                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140         if (err < 0)
 141                 goto done;
 142
 143         switch (chan->chan_type) {
 144         case L2CAP_CHAN_CONN_LESS:
 145                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146                         chan->sec_level = BT_SECURITY_SDP;
 147                 break;
 148         case L2CAP_CHAN_CONN_ORIENTED:
 149                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151                         chan->sec_level = BT_SECURITY_SDP;
 152                 break;
 153         case L2CAP_CHAN_RAW:
 154                 chan->sec_level = BT_SECURITY_SDP;
 155                 break;
 156         case L2CAP_CHAN_FIXED:
 157                 /* Fixed channels default to the L2CAP core not holding a
 158                  * hci_conn reference for them. For fixed channels mapping to
 159                  * L2CAP sockets we do want to hold a reference so set the
 160                  * appropriate flag to request it.
 161                  */
 162                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163                 break;
 164         }
 165
 166         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168          */
 169         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173         chan->state = BT_BOUND;
 174         sk->sk_state = BT_BOUND;
 175
 176 done:
 177         release_sock(sk);
 178         return err;
 179 }
 180
 181 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 182                               int alen, int flags)
 183 {
 184         struct sock *sk = sock->sk;
 185         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 186         struct sockaddr_l2 la;
 187         int len, err = 0;
 188         bool zapped;
 189
 190         BT_DBG("sk %p", sk);
 191
 192         lock_sock(sk);
 193         zapped = sock_flag(sk, SOCK_ZAPPED);
 194         release_sock(sk);
 195
 196         if (zapped)
 197                 return -EINVAL;
 198
 199         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 200             addr->sa_family != AF_BLUETOOTH)
 201                 return -EINVAL;
 202
 203         memset(&la, 0, sizeof(la));
 204         len = min_t(unsigned int, sizeof(la), alen);
 205         memcpy(&la, addr, len);
 206
 207         if (la.l2_cid && la.l2_psm)
 208                 return -EINVAL;
 209
 210         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 211                 return -EINVAL;
 212
 213         /* Check that the socket wasn't bound to something that
 214          * conflicts with the address given to connect(). If chan->src
 215          * is BDADDR_ANY it means bind() was never used, in which case
 216          * chan->src_type and la.l2_bdaddr_type do not need to match.
 217          */
 218         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 219             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 220                 /* Old user space versions will try to incorrectly bind
 221                  * the ATT socket using BDADDR_BREDR. We need to accept
 222                  * this and fix up the source address type only when
 223                  * both the source CID and destination CID indicate
 224                  * ATT. Anything else is an invalid combination.
 225                  */
 226                 if (chan->scid != L2CAP_CID_ATT ||
 227                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 228                         return -EINVAL;
 229
 230                 /* We don't have the hdev available here to make a
 231                  * better decision on random vs public, but since all
 232                  * user space versions that exhibit this issue anyway do
 233                  * not support random local addresses assuming public
 234                  * here is good enough.
 235                  */
 236                 chan->src_type = BDADDR_LE_PUBLIC;
 237         }
 238
 239         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 240                 return -EINVAL;
 241
 242         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 243                 /* We only allow ATT user space socket */
 244                 if (la.l2_cid &&
 245                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 246                         return -EINVAL;
 247         }
 248
 249         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 250          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 251          */
 252         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 253             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 254                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 255
 256         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 257                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 258         if (err)
 259                 return err;
 260
 261         lock_sock(sk);
 262
 263         err = bt_sock_wait_state(sk, BT_CONNECTED,
 264                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 265
 266         release_sock(sk);
 267
 268         return err;
 269 }
 270
 271 static int l2cap_sock_listen(struct socket *sock, int backlog)
 272 {
 273         struct sock *sk = sock->sk;
 274         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 275         int err = 0;
 276
 277         BT_DBG("sk %p backlog %d", sk, backlog);
 278
 279         lock_sock(sk);
 280
 281         if (sk->sk_state != BT_BOUND) {
 282                 err = -EBADFD;
 283                 goto done;
 284         }
 285
 286         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 287                 err = -EINVAL;
 288                 goto done;
 289         }
 290
 291         switch (chan->mode) {
 292         case L2CAP_MODE_BASIC:
 293         case L2CAP_MODE_LE_FLOWCTL:
 294                 break;
 295         case L2CAP_MODE_EXT_FLOWCTL:
 296                 if (!enable_ecred) {
 297                         err = -EOPNOTSUPP;
 298                         goto done;
 299                 }
 300                 break;
 301         case L2CAP_MODE_ERTM:
 302         case L2CAP_MODE_STREAMING:
 303                 if (!disable_ertm)
 304                         break;
 305                 fallthrough;
 306         default:
 307                 err = -EOPNOTSUPP;
 308                 goto done;
 309         }
 310
 311         sk->sk_max_ack_backlog = backlog;
 312         sk->sk_ack_backlog = 0;
 313
 314         /* Listening channels need to use nested locking in order not to
 315          * cause lockdep warnings when the created child channels end up
 316          * being locked in the same thread as the parent channel.
 317          */
 318         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 319
 320         chan->state = BT_LISTEN;
 321         sk->sk_state = BT_LISTEN;
 322
 323 done:
 324         release_sock(sk);
 325         return err;
 326 }
 327
 328 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 329                              int flags, bool kern)
 330 {
 331         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 332         struct sock *sk = sock->sk, *nsk;
 333         long timeo;
 334         int err = 0;
 335
 336         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 337
 338         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 339
 340         BT_DBG("sk %p timeo %ld", sk, timeo);
 341
 342         /* Wait for an incoming connection. (wake-one). */
 343         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 344         while (1) {
 345                 if (sk->sk_state != BT_LISTEN) {
 346                         err = -EBADFD;
 347                         break;
 348                 }
 349
 350                 nsk = bt_accept_dequeue(sk, newsock);
 351                 if (nsk)
 352                         break;
 353
 354                 if (!timeo) {
 355                         err = -EAGAIN;
 356                         break;
 357                 }
 358
 359                 if (signal_pending(current)) {
 360                         err = sock_intr_errno(timeo);
 361                         break;
 362                 }
 363
 364                 release_sock(sk);
 365
 366                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 367
 368                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 369         }
 370         remove_wait_queue(sk_sleep(sk), &wait);
 371
 372         if (err)
 373                 goto done;
 374
 375         newsock->state = SS_CONNECTED;
 376
 377         BT_DBG("new socket %p", nsk);
 378
 379 done:
 380         release_sock(sk);
 381         return err;
 382 }
 383
 384 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 385                               int peer)
 386 {
 387         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 388         struct sock *sk = sock->sk;
 389         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 390
 391         BT_DBG("sock %p, sk %p", sock, sk);
 392
 393         if (peer && sk->sk_state != BT_CONNECTED &&
 394             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 395             sk->sk_state != BT_CONFIG)
 396                 return -ENOTCONN;
 397
 398         memset(la, 0, sizeof(struct sockaddr_l2));
 399         addr->sa_family = AF_BLUETOOTH;
 400
 401         la->l2_psm = chan->psm;
 402
 403         if (peer) {
 404                 bacpy(&la->l2_bdaddr, &chan->dst);
 405                 la->l2_cid = cpu_to_le16(chan->dcid);
 406                 la->l2_bdaddr_type = chan->dst_type;
 407         } else {
 408                 bacpy(&la->l2_bdaddr, &chan->src);
 409                 la->l2_cid = cpu_to_le16(chan->scid);
 410                 la->l2_bdaddr_type = chan->src_type;
 411         }
 412
 413         return sizeof(struct sockaddr_l2);
 414 }
 415
 416 static int l2cap_get_mode(struct l2cap_chan *chan)
 417 {
 418         switch (chan->mode) {
 419         case L2CAP_MODE_BASIC:
 420                 return BT_MODE_BASIC;
 421         case L2CAP_MODE_ERTM:
 422                 return BT_MODE_ERTM;
 423         case L2CAP_MODE_STREAMING:
 424                 return BT_MODE_STREAMING;
 425         case L2CAP_MODE_LE_FLOWCTL:
 426                 return BT_MODE_LE_FLOWCTL;
 427         case L2CAP_MODE_EXT_FLOWCTL:
 428                 return BT_MODE_EXT_FLOWCTL;
 429         }
 430
 431         return -EINVAL;
 432 }
 433
 434 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 435                                      char __user *optval, int __user *optlen)
 436 {
 437         struct sock *sk = sock->sk;
 438         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 439         struct l2cap_options opts;
 440         struct l2cap_conninfo cinfo;
 441         int len, err = 0;
 442         u32 opt;
 443
 444         BT_DBG("sk %p", sk);
 445
 446         if (get_user(len, optlen))
 447                 return -EFAULT;
 448
 449         lock_sock(sk);
 450
 451         switch (optname) {
 452         case L2CAP_OPTIONS:
 453                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 454                  * legacy ATT code depends on getsockopt for
 455                  * L2CAP_OPTIONS we need to let this pass.
 456                  */
 457                 if (bdaddr_type_is_le(chan->src_type) &&
 458                     chan->scid != L2CAP_CID_ATT) {
 459                         err = -EINVAL;
 460                         break;
 461                 }
 462
 463                 /* Only BR/EDR modes are supported here */
 464                 switch (chan->mode) {
 465                 case L2CAP_MODE_BASIC:
 466                 case L2CAP_MODE_ERTM:
 467                 case L2CAP_MODE_STREAMING:
 468                         break;
 469                 default:
 470                         err = -EINVAL;
 471                         break;
 472                 }
 473
 474                 if (err < 0)
 475                         break;
 476
 477                 memset(&opts, 0, sizeof(opts));
 478                 opts.imtu     = chan->imtu;
 479                 opts.omtu     = chan->omtu;
 480                 opts.flush_to = chan->flush_to;
 481                 opts.mode     = chan->mode;
 482                 opts.fcs      = chan->fcs;
 483                 opts.max_tx   = chan->max_tx;
 484                 opts.txwin_size = chan->tx_win;
 485
 486                 BT_DBG("mode 0x%2.2x", chan->mode);
 487
 488                 len = min_t(unsigned int, len, sizeof(opts));
 489                 if (copy_to_user(optval, (char *) &opts, len))
 490                         err = -EFAULT;
 491
 492                 break;
 493
 494         case L2CAP_LM:
 495                 switch (chan->sec_level) {
 496                 case BT_SECURITY_LOW:
 497                         opt = L2CAP_LM_AUTH;
 498                         break;
 499                 case BT_SECURITY_MEDIUM:
 500                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 501                         break;
 502                 case BT_SECURITY_HIGH:
 503                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 504                               L2CAP_LM_SECURE;
 505                         break;
 506                 case BT_SECURITY_FIPS:
 507                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 508                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 509                         break;
 510                 default:
 511                         opt = 0;
 512                         break;
 513                 }
 514
 515                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 516                         opt |= L2CAP_LM_MASTER;
 517
 518                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 519                         opt |= L2CAP_LM_RELIABLE;
 520
 521                 if (put_user(opt, (u32 __user *) optval))
 522                         err = -EFAULT;
 523
 524                 break;
 525
 526         case L2CAP_CONNINFO:
 527                 if (sk->sk_state != BT_CONNECTED &&
 528                     !(sk->sk_state == BT_CONNECT2 &&
 529                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 530                         err = -ENOTCONN;
 531                         break;
 532                 }
 533
 534                 memset(&cinfo, 0, sizeof(cinfo));
 535                 cinfo.hci_handle = chan->conn->hcon->handle;
 536                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 537
 538                 len = min_t(unsigned int, len, sizeof(cinfo));
 539                 if (copy_to_user(optval, (char *) &cinfo, len))
 540                         err = -EFAULT;
 541
 542                 break;
 543
 544         default:
 545                 err = -ENOPROTOOPT;
 546                 break;
 547         }
 548
 549         release_sock(sk);
 550         return err;
 551 }
 552
 553 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 554                                  char __user *optval, int __user *optlen)
 555 {
 556         struct sock *sk = sock->sk;
 557         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 558         struct bt_security sec;
 559         struct bt_power pwr;
 560         u32 phys;
 561         int len, mode, err = 0;
 562
 563         BT_DBG("sk %p", sk);
 564
 565         if (level == SOL_L2CAP)
 566                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 567
 568         if (level != SOL_BLUETOOTH)
 569                 return -ENOPROTOOPT;
 570
 571         if (get_user(len, optlen))
 572                 return -EFAULT;
 573
 574         lock_sock(sk);
 575
 576         switch (optname) {
 577         case BT_SECURITY:
 578                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 579                     chan->chan_type != L2CAP_CHAN_FIXED &&
 580                     chan->chan_type != L2CAP_CHAN_RAW) {
 581                         err = -EINVAL;
 582                         break;
 583                 }
 584
 585                 memset(&sec, 0, sizeof(sec));
 586                 if (chan->conn) {
 587                         sec.level = chan->conn->hcon->sec_level;
 588
 589                         if (sk->sk_state == BT_CONNECTED)
 590                                 sec.key_size = chan->conn->hcon->enc_key_size;
 591                 } else {
 592                         sec.level = chan->sec_level;
 593                 }
 594
 595                 len = min_t(unsigned int, len, sizeof(sec));
 596                 if (copy_to_user(optval, (char *) &sec, len))
 597                         err = -EFAULT;
 598
 599                 break;
 600
 601         case BT_DEFER_SETUP:
 602                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 603                         err = -EINVAL;
 604                         break;
 605                 }
 606
 607                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 608                              (u32 __user *) optval))
 609                         err = -EFAULT;
 610
 611                 break;
 612
 613         case BT_FLUSHABLE:
 614                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 615                              (u32 __user *) optval))
 616                         err = -EFAULT;
 617
 618                 break;
 619
 620         case BT_POWER:
 621                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 622                     && sk->sk_type != SOCK_RAW) {
 623                         err = -EINVAL;
 624                         break;
 625                 }
 626
 627                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 628
 629                 len = min_t(unsigned int, len, sizeof(pwr));
 630                 if (copy_to_user(optval, (char *) &pwr, len))
 631                         err = -EFAULT;
 632
 633                 break;
 634
 635         case BT_CHANNEL_POLICY:
 636                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 637                         err = -EFAULT;
 638                 break;
 639
 640         case BT_SNDMTU:
 641                 if (!bdaddr_type_is_le(chan->src_type)) {
 642                         err = -EINVAL;
 643                         break;
 644                 }
 645
 646                 if (sk->sk_state != BT_CONNECTED) {
 647                         err = -ENOTCONN;
 648                         break;
 649                 }
 650
 651                 if (put_user(chan->omtu, (u16 __user *) optval))
 652                         err = -EFAULT;
 653                 break;
 654
 655         case BT_RCVMTU:
 656                 if (!bdaddr_type_is_le(chan->src_type)) {
 657                         err = -EINVAL;
 658                         break;
 659                 }
 660
 661                 if (put_user(chan->imtu, (u16 __user *) optval))
 662                         err = -EFAULT;
 663                 break;
 664
 665         case BT_PHY:
 666                 if (sk->sk_state != BT_CONNECTED) {
 667                         err = -ENOTCONN;
 668                         break;
 669                 }
 670
 671                 phys = hci_conn_get_phy(chan->conn->hcon);
 672
 673                 if (put_user(phys, (u32 __user *) optval))
 674                         err = -EFAULT;
 675                 break;
 676
 677         case BT_MODE:
 678                 if (!enable_ecred) {
 679                         err = -ENOPROTOOPT;
 680                         break;
 681                 }
 682
 683                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 684                         err = -EINVAL;
 685                         break;
 686                 }
 687
 688                 mode = l2cap_get_mode(chan);
 689                 if (mode < 0) {
 690                         err = mode;
 691                         break;
 692                 }
 693
 694                 if (put_user(mode, (u8 __user *) optval))
 695                         err = -EFAULT;
 696                 break;
 697
 698         default:
 699                 err = -ENOPROTOOPT;
 700                 break;
 701         }
 702
 703         release_sock(sk);
 704         return err;
 705 }
 706
 707 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 708 {
 709         switch (chan->scid) {
 710         case L2CAP_CID_ATT:
 711                 if (mtu < L2CAP_LE_MIN_MTU)
 712                         return false;
 713                 break;
 714
 715         default:
 716                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 717                         return false;
 718         }
 719
 720         return true;
 721 }
 722
 723 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 724                                      sockptr_t optval, unsigned int optlen)
 725 {
 726         struct sock *sk = sock->sk;
 727         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 728         struct l2cap_options opts;
 729         int err = 0;
 730         u32 opt;
 731
 732         BT_DBG("sk %p", sk);
 733
 734         lock_sock(sk);
 735
 736         switch (optname) {
 737         case L2CAP_OPTIONS:
 738                 if (bdaddr_type_is_le(chan->src_type)) {
 739                         err = -EINVAL;
 740                         break;
 741                 }
 742
 743                 if (sk->sk_state == BT_CONNECTED) {
 744                         err = -EINVAL;
 745                         break;
 746                 }
 747
 748                 opts.imtu     = chan->imtu;
 749                 opts.omtu     = chan->omtu;
 750                 opts.flush_to = chan->flush_to;
 751                 opts.mode     = chan->mode;
 752                 opts.fcs      = chan->fcs;
 753                 opts.max_tx   = chan->max_tx;
 754                 opts.txwin_size = chan->tx_win;
 755
 756                 err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
 757                 if (err)
 758                         break;
 759
 760                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 761                         err = -EINVAL;
 762                         break;
 763                 }
 764
 765                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 766                         err = -EINVAL;
 767                         break;
 768                 }
 769
 770                 /* Only BR/EDR modes are supported here */
 771                 switch (opts.mode) {
 772                 case L2CAP_MODE_BASIC:
 773                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 774                         break;
 775                 case L2CAP_MODE_ERTM:
 776                 case L2CAP_MODE_STREAMING:
 777                         if (!disable_ertm)
 778                                 break;
 779                         fallthrough;
 780                 default:
 781                         err = -EINVAL;
 782                         break;
 783                 }
 784
 785                 if (err < 0)
 786                         break;
 787
 788                 chan->mode = opts.mode;
 789
 790                 BT_DBG("mode 0x%2.2x", chan->mode);
 791
 792                 chan->imtu = opts.imtu;
 793                 chan->omtu = opts.omtu;
 794                 chan->fcs  = opts.fcs;
 795                 chan->max_tx = opts.max_tx;
 796                 chan->tx_win = opts.txwin_size;
 797                 chan->flush_to = opts.flush_to;
 798                 break;
 799
 800         case L2CAP_LM:
 801                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 802                 if (err)
 803                         break;
 804
 805                 if (opt & L2CAP_LM_FIPS) {
 806                         err = -EINVAL;
 807                         break;
 808                 }
 809
 810                 if (opt & L2CAP_LM_AUTH)
 811                         chan->sec_level = BT_SECURITY_LOW;
 812                 if (opt & L2CAP_LM_ENCRYPT)
 813                         chan->sec_level = BT_SECURITY_MEDIUM;
 814                 if (opt & L2CAP_LM_SECURE)
 815                         chan->sec_level = BT_SECURITY_HIGH;
 816
 817                 if (opt & L2CAP_LM_MASTER)
 818                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 819                 else
 820                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 821
 822                 if (opt & L2CAP_LM_RELIABLE)
 823                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 824                 else
 825                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 826                 break;
 827
 828         default:
 829                 err = -ENOPROTOOPT;
 830                 break;
 831         }
 832
 833         release_sock(sk);
 834         return err;
 835 }
 836
 837 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 838 {
 839         switch (mode) {
 840         case BT_MODE_BASIC:
 841                 if (bdaddr_type_is_le(chan->src_type))
 842                         return -EINVAL;
 843                 mode = L2CAP_MODE_BASIC;
 844                 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 845                 break;
 846         case BT_MODE_ERTM:
 847                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 848                         return -EINVAL;
 849                 mode = L2CAP_MODE_ERTM;
 850                 break;
 851         case BT_MODE_STREAMING:
 852                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 853                         return -EINVAL;
 854                 mode = L2CAP_MODE_STREAMING;
 855                 break;
 856         case BT_MODE_LE_FLOWCTL:
 857                 if (!bdaddr_type_is_le(chan->src_type))
 858                         return -EINVAL;
 859                 mode = L2CAP_MODE_LE_FLOWCTL;
 860                 break;
 861         case BT_MODE_EXT_FLOWCTL:
 862                 /* TODO: Add support for ECRED PDUs to BR/EDR */
 863                 if (!bdaddr_type_is_le(chan->src_type))
 864                         return -EINVAL;
 865                 mode = L2CAP_MODE_EXT_FLOWCTL;
 866                 break;
 867         default:
 868                 return -EINVAL;
 869         }
 870
 871         chan->mode = mode;
 872
 873         return 0;
 874 }
 875
 876 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 877                                  sockptr_t optval, unsigned int optlen)
 878 {
 879         struct sock *sk = sock->sk;
 880         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 881         struct bt_security sec;
 882         struct bt_power pwr;
 883         struct l2cap_conn *conn;
 884         int err = 0;
 885         u32 opt;
 886         u16 mtu;
 887         u8 mode;
 888
 889         BT_DBG("sk %p", sk);
 890
 891         if (level == SOL_L2CAP)
 892                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 893
 894         if (level != SOL_BLUETOOTH)
 895                 return -ENOPROTOOPT;
 896
 897         lock_sock(sk);
 898
 899         switch (optname) {
 900         case BT_SECURITY:
 901                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 902                     chan->chan_type != L2CAP_CHAN_FIXED &&
 903                     chan->chan_type != L2CAP_CHAN_RAW) {
 904                         err = -EINVAL;
 905                         break;
 906                 }
 907
 908                 sec.level = BT_SECURITY_LOW;
 909
 910                 err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
 911                 if (err)
 912                         break;
 913
 914                 if (sec.level < BT_SECURITY_LOW ||
 915                     sec.level > BT_SECURITY_FIPS) {
 916                         err = -EINVAL;
 917                         break;
 918                 }
 919
 920                 chan->sec_level = sec.level;
 921
 922                 if (!chan->conn)
 923                         break;
 924
 925                 conn = chan->conn;
 926
 927                 /* change security for LE channels */
 928                 if (chan->scid == L2CAP_CID_ATT) {
 929                         if (smp_conn_security(conn->hcon, sec.level)) {
 930                                 err = -EINVAL;
 931                                 break;
 932                         }
 933
 934                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 935                         sk->sk_state = BT_CONFIG;
 936                         chan->state = BT_CONFIG;
 937
 938                 /* or for ACL link */
 939                 } else if ((sk->sk_state == BT_CONNECT2 &&
 940                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 941                            sk->sk_state == BT_CONNECTED) {
 942                         if (!l2cap_chan_check_security(chan, true))
 943                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 944                         else
 945                                 sk->sk_state_change(sk);
 946                 } else {
 947                         err = -EINVAL;
 948                 }
 949                 break;
 950
 951         case BT_DEFER_SETUP:
 952                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 953                         err = -EINVAL;
 954                         break;
 955                 }
 956
 957                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 958                 if (err)
 959                         break;
 960
 961                 if (opt) {
 962                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 963                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 964                 } else {
 965                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 966                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 967                 }
 968                 break;
 969
 970         case BT_FLUSHABLE:
 971                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 972                 if (err)
 973                         break;
 974
 975                 if (opt > BT_FLUSHABLE_ON) {
 976                         err = -EINVAL;
 977                         break;
 978                 }
 979
 980                 if (opt == BT_FLUSHABLE_OFF) {
 981                         conn = chan->conn;
 982                         /* proceed further only when we have l2cap_conn and
 983                            No Flush support in the LM */
 984                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 985                                 err = -EINVAL;
 986                                 break;
 987                         }
 988                 }
 989
 990                 if (opt)
 991                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 992                 else
 993                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 994                 break;
 995
 996         case BT_POWER:
 997                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 998                     chan->chan_type != L2CAP_CHAN_RAW) {
 999                         err = -EINVAL;
1000                         break;
1001                 }
1002
1003                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1004
1005                 err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1006                 if (err)
1007                         break;
1008
1009                 if (pwr.force_active)
1010                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1011                 else
1012                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1013                 break;
1014
1015         case BT_CHANNEL_POLICY:
1016                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
1017                 if (err)
1018                         break;
1019
1020                 err = -EOPNOTSUPP;
1021                 break;
1022
1023         case BT_SNDMTU:
1024                 if (!bdaddr_type_is_le(chan->src_type)) {
1025                         err = -EINVAL;
1026                         break;
1027                 }
1028
1029                 /* Setting is not supported as it's the remote side that
1030                  * decides this.
1031                  */
1032                 err = -EPERM;
1033                 break;
1034
1035         case BT_RCVMTU:
1036                 if (!bdaddr_type_is_le(chan->src_type)) {
1037                         err = -EINVAL;
1038                         break;
1039                 }
1040
1041                 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1042                     sk->sk_state == BT_CONNECTED) {
1043                         err = -EISCONN;
1044                         break;
1045                 }
1046
1047                 err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1048                 if (err)
1049                         break;
1050
1051                 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1052                     sk->sk_state == BT_CONNECTED)
1053                         err = l2cap_chan_reconfigure(chan, mtu);
1054                 else
1055                         chan->imtu = mtu;
1056
1057                 break;
1058
1059         case BT_MODE:
1060                 if (!enable_ecred) {
1061                         err = -ENOPROTOOPT;
1062                         break;
1063                 }
1064
1065                 BT_DBG("sk->sk_state %u", sk->sk_state);
1066
1067                 if (sk->sk_state != BT_BOUND) {
1068                         err = -EINVAL;
1069                         break;
1070                 }
1071
1072                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1073                         err = -EINVAL;
1074                         break;
1075                 }
1076
1077                 err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
1078                 if (err)
1079                         break;
1080
1081                 BT_DBG("mode %u", mode);
1082
1083                 err = l2cap_set_mode(chan, mode);
1084                 if (err)
1085                         break;
1086
1087                 BT_DBG("mode 0x%2.2x", chan->mode);
1088
1089                 break;
1090
1091         default:
1092                 err = -ENOPROTOOPT;
1093                 break;
1094         }
1095
1096         release_sock(sk);
1097         return err;
1098 }
1099
1100 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1101                               size_t len)
1102 {
1103         struct sock *sk = sock->sk;
1104         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1105         int err;
1106
1107         BT_DBG("sock %p, sk %p", sock, sk);
1108
1109         err = sock_error(sk);
1110         if (err)
1111                 return err;
1112
1113         if (msg->msg_flags & MSG_OOB)
1114                 return -EOPNOTSUPP;
1115
1116         if (sk->sk_state != BT_CONNECTED)
1117                 return -ENOTCONN;
1118
1119         lock_sock(sk);
1120         err = bt_sock_wait_ready(sk, msg->msg_flags);
1121         release_sock(sk);
1122         if (err)
1123                 return err;
1124
1125         l2cap_chan_lock(chan);
1126         err = l2cap_chan_send(chan, msg, len);
1127         l2cap_chan_unlock(chan);
1128
1129         return err;
1130 }
1131
1132 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1133                               size_t len, int flags)
1134 {
1135         struct sock *sk = sock->sk;
1136         struct l2cap_pinfo *pi = l2cap_pi(sk);
1137         int err;
1138
1139         lock_sock(sk);
1140
1141         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1142                                                     &bt_sk(sk)->flags)) {
1143                 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1144                         sk->sk_state = BT_CONNECTED;
1145                         pi->chan->state = BT_CONNECTED;
1146                         __l2cap_ecred_conn_rsp_defer(pi->chan);
1147                 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1148                         sk->sk_state = BT_CONNECTED;
1149                         pi->chan->state = BT_CONNECTED;
1150                         __l2cap_le_connect_rsp_defer(pi->chan);
1151                 } else {
1152                         sk->sk_state = BT_CONFIG;
1153                         pi->chan->state = BT_CONFIG;
1154                         __l2cap_connect_rsp_defer(pi->chan);
1155                 }
1156
1157                 err = 0;
1158                 goto done;
1159         }
1160
1161         release_sock(sk);
1162
1163         if (sock->type == SOCK_STREAM)
1164                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1165         else
1166                 err = bt_sock_recvmsg(sock, msg, len, flags);
1167
1168         if (pi->chan->mode != L2CAP_MODE_ERTM)
1169                 return err;
1170
1171         /* Attempt to put pending rx data in the socket buffer */
1172
1173         lock_sock(sk);
1174
1175         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1176                 goto done;
1177
1178         if (pi->rx_busy_skb) {
1179                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1180                         pi->rx_busy_skb = NULL;
1181                 else
1182                         goto done;
1183         }
1184
1185         /* Restore data flow when half of the receive buffer is
1186          * available.  This avoids resending large numbers of
1187          * frames.
1188          */
1189         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1190                 l2cap_chan_busy(pi->chan, 0);
1191
1192 done:
1193         release_sock(sk);
1194         return err;
1195 }
1196
1197 /* Kill socket (only if zapped and orphan)
1198  * Must be called on unlocked socket, with l2cap channel lock.
1199  */
1200 static void l2cap_sock_kill(struct sock *sk)
1201 {
1202         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1203                 return;
1204
1205         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1206
1207         /* Kill poor orphan */
1208
1209         l2cap_chan_put(l2cap_pi(sk)->chan);
1210         sock_set_flag(sk, SOCK_DEAD);
1211         sock_put(sk);
1212 }
1213
1214 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1215 {
1216         DECLARE_WAITQUEUE(wait, current);
1217         int err = 0;
1218         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1219         /* Timeout to prevent infinite loop */
1220         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1221
1222         add_wait_queue(sk_sleep(sk), &wait);
1223         set_current_state(TASK_INTERRUPTIBLE);
1224         do {
1225                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1226                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1227                        jiffies_to_msecs(timeout - jiffies));
1228
1229                 if (!timeo)
1230                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1231
1232                 if (signal_pending(current)) {
1233                         err = sock_intr_errno(timeo);
1234                         break;
1235                 }
1236
1237                 release_sock(sk);
1238                 timeo = schedule_timeout(timeo);
1239                 lock_sock(sk);
1240                 set_current_state(TASK_INTERRUPTIBLE);
1241
1242                 err = sock_error(sk);
1243                 if (err)
1244                         break;
1245
1246                 if (time_after(jiffies, timeout)) {
1247                         err = -ENOLINK;
1248                         break;
1249                 }
1250
1251         } while (chan->unacked_frames > 0 &&
1252                  chan->state == BT_CONNECTED);
1253
1254         set_current_state(TASK_RUNNING);
1255         remove_wait_queue(sk_sleep(sk), &wait);
1256         return err;
1257 }
1258
1259 static int l2cap_sock_shutdown(struct socket *sock, int how)
1260 {
1261         struct sock *sk = sock->sk;
1262         struct l2cap_chan *chan;
1263         struct l2cap_conn *conn;
1264         int err = 0;
1265
1266         BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1267
1268         /* 'how' parameter is mapped to sk_shutdown as follows:
1269          * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1270          * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1271          * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1272          */
1273         how++;
1274
1275         if (!sk)
1276                 return 0;
1277
1278         lock_sock(sk);
1279
1280         if ((sk->sk_shutdown & how) == how)
1281                 goto shutdown_already;
1282
1283         BT_DBG("Handling sock shutdown");
1284
1285         /* prevent sk structure from being freed whilst unlocked */
1286         sock_hold(sk);
1287
1288         chan = l2cap_pi(sk)->chan;
1289         /* prevent chan structure from being freed whilst unlocked */
1290         l2cap_chan_hold(chan);
1291
1292         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1293
1294         if (chan->mode == L2CAP_MODE_ERTM &&
1295             chan->unacked_frames > 0 &&
1296             chan->state == BT_CONNECTED) {
1297                 err = __l2cap_wait_ack(sk, chan);
1298
1299                 /* After waiting for ACKs, check whether shutdown
1300                  * has already been actioned to close the L2CAP
1301                  * link such as by l2cap_disconnection_req().
1302                  */
1303                 if ((sk->sk_shutdown & how) == how)
1304                         goto shutdown_matched;
1305         }
1306
1307         /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1308          * is already set
1309          */
1310         if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1311                 sk->sk_shutdown |= RCV_SHUTDOWN;
1312                 if ((sk->sk_shutdown & how) == how)
1313                         goto shutdown_matched;
1314         }
1315
1316         sk->sk_shutdown |= SEND_SHUTDOWN;
1317         release_sock(sk);
1318
1319         l2cap_chan_lock(chan);
1320         conn = chan->conn;
1321         if (conn)
1322                 /* prevent conn structure from being freed */
1323                 l2cap_conn_get(conn);
1324         l2cap_chan_unlock(chan);
1325
1326         if (conn)
1327                 /* mutex lock must be taken before l2cap_chan_lock() */
1328                 mutex_lock(&conn->chan_lock);
1329
1330         l2cap_chan_lock(chan);
1331         l2cap_chan_close(chan, 0);
1332         l2cap_chan_unlock(chan);
1333
1334         if (conn) {
1335                 mutex_unlock(&conn->chan_lock);
1336                 l2cap_conn_put(conn);
1337         }
1338
1339         lock_sock(sk);
1340
1341         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1342             !(current->flags & PF_EXITING))
1343                 err = bt_sock_wait_state(sk, BT_CLOSED,
1344                                          sk->sk_lingertime);
1345
1346 shutdown_matched:
1347         l2cap_chan_put(chan);
1348         sock_put(sk);
1349
1350 shutdown_already:
1351         if (!err && sk->sk_err)
1352                 err = -sk->sk_err;
1353
1354         release_sock(sk);
1355
1356         BT_DBG("Sock shutdown complete err: %d", err);
1357
1358         return err;
1359 }
1360
1361 static int l2cap_sock_release(struct socket *sock)
1362 {
1363         struct sock *sk = sock->sk;
1364         int err;
1365         struct l2cap_chan *chan;
1366
1367         BT_DBG("sock %p, sk %p", sock, sk);
1368
1369         if (!sk)
1370                 return 0;
1371
1372         l2cap_sock_cleanup_listen(sk);
1373         bt_sock_unlink(&l2cap_sk_list, sk);
1374
1375         err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1376         chan = l2cap_pi(sk)->chan;
1377
1378         l2cap_chan_hold(chan);
1379         l2cap_chan_lock(chan);
1380
1381         sock_orphan(sk);
1382         l2cap_sock_kill(sk);
1383
1384         l2cap_chan_unlock(chan);
1385         l2cap_chan_put(chan);
1386
1387         return err;
1388 }
1389
1390 static void l2cap_sock_cleanup_listen(struct sock *parent)
1391 {
1392         struct sock *sk;
1393
1394         BT_DBG("parent %p state %s", parent,
1395                state_to_string(parent->sk_state));
1396
1397         /* Close not yet accepted channels */
1398         while ((sk = bt_accept_dequeue(parent, NULL))) {
1399                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1400
1401                 BT_DBG("child chan %p state %s", chan,
1402                        state_to_string(chan->state));
1403
1404                 l2cap_chan_hold(chan);
1405                 l2cap_chan_lock(chan);
1406
1407                 __clear_chan_timer(chan);
1408                 l2cap_chan_close(chan, ECONNRESET);
1409                 l2cap_sock_kill(sk);
1410
1411                 l2cap_chan_unlock(chan);
1412                 l2cap_chan_put(chan);
1413         }
1414 }
1415
1416 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1417 {
1418         struct sock *sk, *parent = chan->data;
1419
1420         lock_sock(parent);
1421
1422         /* Check for backlog size */
1423         if (sk_acceptq_is_full(parent)) {
1424                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1425                 release_sock(parent);
1426                 return NULL;
1427         }
1428
1429         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1430                               GFP_ATOMIC, 0);
1431         if (!sk) {
1432                 release_sock(parent);
1433                 return NULL;
1434         }
1435
1436         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1437
1438         l2cap_sock_init(sk, parent);
1439
1440         bt_accept_enqueue(parent, sk, false);
1441
1442         release_sock(parent);
1443
1444         return l2cap_pi(sk)->chan;
1445 }
1446
1447 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1448 {
1449         struct sock *sk = chan->data;
1450         int err;
1451
1452         lock_sock(sk);
1453
1454         if (l2cap_pi(sk)->rx_busy_skb) {
1455                 err = -ENOMEM;
1456                 goto done;
1457         }
1458
1459         if (chan->mode != L2CAP_MODE_ERTM &&
1460             chan->mode != L2CAP_MODE_STREAMING) {
1461                 /* Even if no filter is attached, we could potentially
1462                  * get errors from security modules, etc.
1463                  */
1464                 err = sk_filter(sk, skb);
1465                 if (err)
1466                         goto done;
1467         }
1468
1469         err = __sock_queue_rcv_skb(sk, skb);
1470
1471         /* For ERTM, handle one skb that doesn't fit into the recv
1472          * buffer.  This is important to do because the data frames
1473          * have already been acked, so the skb cannot be discarded.
1474          *
1475          * Notify the l2cap core that the buffer is full, so the
1476          * LOCAL_BUSY state is entered and no more frames are
1477          * acked and reassembled until there is buffer space
1478          * available.
1479          */
1480         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1481                 l2cap_pi(sk)->rx_busy_skb = skb;
1482                 l2cap_chan_busy(chan, 1);
1483                 err = 0;
1484         }
1485
1486 done:
1487         release_sock(sk);
1488
1489         return err;
1490 }
1491
1492 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1493 {
1494         struct sock *sk = chan->data;
1495
1496         if (!sk)
1497                 return;
1498
1499         l2cap_sock_kill(sk);
1500 }
1501
1502 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1503 {
1504         struct sock *sk = chan->data;
1505         struct sock *parent;
1506
1507         if (!sk)
1508                 return;
1509
1510         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1511
1512         /* This callback can be called both for server (BT_LISTEN)
1513          * sockets as well as "normal" ones. To avoid lockdep warnings
1514          * with child socket locking (through l2cap_sock_cleanup_listen)
1515          * we need separation into separate nesting levels. The simplest
1516          * way to accomplish this is to inherit the nesting level used
1517          * for the channel.
1518          */
1519         lock_sock_nested(sk, atomic_read(&chan->nesting));
1520
1521         parent = bt_sk(sk)->parent;
1522
1523         switch (chan->state) {
1524         case BT_OPEN:
1525         case BT_BOUND:
1526         case BT_CLOSED:
1527                 break;
1528         case BT_LISTEN:
1529                 l2cap_sock_cleanup_listen(sk);
1530                 sk->sk_state = BT_CLOSED;
1531                 chan->state = BT_CLOSED;
1532
1533                 break;
1534         default:
1535                 sk->sk_state = BT_CLOSED;
1536                 chan->state = BT_CLOSED;
1537
1538                 sk->sk_err = err;
1539
1540                 if (parent) {
1541                         bt_accept_unlink(sk);
1542                         parent->sk_data_ready(parent);
1543                 } else {
1544                         sk->sk_state_change(sk);
1545                 }
1546
1547                 break;
1548         }
1549         release_sock(sk);
1550
1551         /* Only zap after cleanup to avoid use after free race */
1552         sock_set_flag(sk, SOCK_ZAPPED);
1553
1554 }
1555
1556 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1557                                        int err)
1558 {
1559         struct sock *sk = chan->data;
1560
1561         sk->sk_state = state;
1562
1563         if (err)
1564                 sk->sk_err = err;
1565 }
1566
1567 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1568                                                unsigned long hdr_len,
1569                                                unsigned long len, int nb)
1570 {
1571         struct sock *sk = chan->data;
1572         struct sk_buff *skb;
1573         int err;
1574
1575         l2cap_chan_unlock(chan);
1576         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1577         l2cap_chan_lock(chan);
1578
1579         if (!skb)
1580                 return ERR_PTR(err);
1581
1582         /* Channel lock is released before requesting new skb and then
1583          * reacquired thus we need to recheck channel state.
1584          */
1585         if (chan->state != BT_CONNECTED) {
1586                 kfree_skb(skb);
1587                 return ERR_PTR(-ENOTCONN);
1588         }
1589
1590         skb->priority = READ_ONCE(sk->sk_priority);
1591
1592         bt_cb(skb)->l2cap.chan = chan;
1593
1594         return skb;
1595 }
1596
1597 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1598 {
1599         struct sock *sk = chan->data;
1600         struct sock *parent;
1601
1602         lock_sock(sk);
1603
1604         parent = bt_sk(sk)->parent;
1605
1606         BT_DBG("sk %p, parent %p", sk, parent);
1607
1608         sk->sk_state = BT_CONNECTED;
1609         sk->sk_state_change(sk);
1610
1611         if (parent)
1612                 parent->sk_data_ready(parent);
1613
1614         release_sock(sk);
1615 }
1616
1617 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1618 {
1619         struct sock *parent, *sk = chan->data;
1620
1621         lock_sock(sk);
1622
1623         parent = bt_sk(sk)->parent;
1624         if (parent)
1625                 parent->sk_data_ready(parent);
1626
1627         release_sock(sk);
1628 }
1629
1630 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1631 {
1632         struct sock *sk = chan->data;
1633
1634         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1635                 sk->sk_state = BT_CONNECTED;
1636                 chan->state = BT_CONNECTED;
1637         }
1638
1639         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1640         sk->sk_state_change(sk);
1641 }
1642
1643 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1644 {
1645         struct sock *sk = chan->data;
1646
1647         lock_sock(sk);
1648         sk->sk_shutdown = SHUTDOWN_MASK;
1649         release_sock(sk);
1650 }
1651
1652 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1653 {
1654         struct sock *sk = chan->data;
1655
1656         return sk->sk_sndtimeo;
1657 }
1658
1659 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1660 {
1661         struct sock *sk = chan->data;
1662
1663         return sk->sk_peer_pid;
1664 }
1665
1666 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1667 {
1668         struct sock *sk = chan->data;
1669
1670         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1671         sk->sk_state_change(sk);
1672 }
1673
1674 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1675 {
1676         struct sock *sk = chan->data;
1677
1678         switch (chan->mode) {
1679         case L2CAP_MODE_ERTM:
1680         case L2CAP_MODE_STREAMING:
1681                 return sk_filter(sk, skb);
1682         }
1683
1684         return 0;
1685 }
1686
1687 static const struct l2cap_ops l2cap_chan_ops = {
1688         .name                   = "L2CAP Socket Interface",
1689         .new_connection         = l2cap_sock_new_connection_cb,
1690         .recv                   = l2cap_sock_recv_cb,
1691         .close                  = l2cap_sock_close_cb,
1692         .teardown               = l2cap_sock_teardown_cb,
1693         .state_change           = l2cap_sock_state_change_cb,
1694         .ready                  = l2cap_sock_ready_cb,
1695         .defer                  = l2cap_sock_defer_cb,
1696         .resume                 = l2cap_sock_resume_cb,
1697         .suspend                = l2cap_sock_suspend_cb,
1698         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1699         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1700         .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
1701         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1702         .filter                 = l2cap_sock_filter,
1703 };
1704
1705 static void l2cap_sock_destruct(struct sock *sk)
1706 {
1707         BT_DBG("sk %p", sk);
1708
1709         if (l2cap_pi(sk)->chan) {
1710                 l2cap_pi(sk)->chan->data = NULL;
1711                 l2cap_chan_put(l2cap_pi(sk)->chan);
1712         }
1713
1714         if (l2cap_pi(sk)->rx_busy_skb) {
1715                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1716                 l2cap_pi(sk)->rx_busy_skb = NULL;
1717         }
1718
1719         skb_queue_purge(&sk->sk_receive_queue);
1720         skb_queue_purge(&sk->sk_write_queue);
1721 }
1722
1723 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1724                                int *msg_namelen)
1725 {
1726         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1727
1728         memset(la, 0, sizeof(struct sockaddr_l2));
1729         la->l2_family = AF_BLUETOOTH;
1730         la->l2_psm = bt_cb(skb)->l2cap.psm;
1731         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1732
1733         *msg_namelen = sizeof(struct sockaddr_l2);
1734 }
1735
1736 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1737 {
1738         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1739
1740         BT_DBG("sk %p", sk);
1741
1742         if (parent) {
1743                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1744
1745                 sk->sk_type = parent->sk_type;
1746                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1747
1748                 chan->chan_type = pchan->chan_type;
1749                 chan->imtu = pchan->imtu;
1750                 chan->omtu = pchan->omtu;
1751                 chan->conf_state = pchan->conf_state;
1752                 chan->mode = pchan->mode;
1753                 chan->fcs  = pchan->fcs;
1754                 chan->max_tx = pchan->max_tx;
1755                 chan->tx_win = pchan->tx_win;
1756                 chan->tx_win_max = pchan->tx_win_max;
1757                 chan->sec_level = pchan->sec_level;
1758                 chan->flags = pchan->flags;
1759                 chan->tx_credits = pchan->tx_credits;
1760                 chan->rx_credits = pchan->rx_credits;
1761
1762                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1763                         chan->scid = pchan->scid;
1764                         chan->dcid = pchan->scid;
1765                 }
1766
1767                 security_sk_clone(parent, sk);
1768         } else {
1769                 switch (sk->sk_type) {
1770                 case SOCK_RAW:
1771                         chan->chan_type = L2CAP_CHAN_RAW;
1772                         break;
1773                 case SOCK_DGRAM:
1774                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1775                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1776                         break;
1777                 case SOCK_SEQPACKET:
1778                 case SOCK_STREAM:
1779                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1780                         break;
1781                 }
1782
1783                 chan->imtu = L2CAP_DEFAULT_MTU;
1784                 chan->omtu = 0;
1785                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1786                         chan->mode = L2CAP_MODE_ERTM;
1787                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1788                 } else {
1789                         chan->mode = L2CAP_MODE_BASIC;
1790                 }
1791
1792                 l2cap_chan_set_defaults(chan);
1793         }
1794
1795         /* Default config options */
1796         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1797
1798         chan->data = sk;
1799         chan->ops = &l2cap_chan_ops;
1800 }
1801
1802 static struct proto l2cap_proto = {
1803         .name           = "L2CAP",
1804         .owner          = THIS_MODULE,
1805         .obj_size       = sizeof(struct l2cap_pinfo)
1806 };
1807
1808 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1809                                      int proto, gfp_t prio, int kern)
1810 {
1811         struct sock *sk;
1812         struct l2cap_chan *chan;
1813
1814         sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
1815         if (!sk)
1816                 return NULL;
1817
1818         sk->sk_destruct = l2cap_sock_destruct;
1819         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1820
1821         chan = l2cap_chan_create();
1822         if (!chan) {
1823                 sk_free(sk);
1824                 return NULL;
1825         }
1826
1827         l2cap_chan_hold(chan);
1828
1829         l2cap_pi(sk)->chan = chan;
1830
1831         return sk;
1832 }
1833
1834 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1835                              int kern)
1836 {
1837         struct sock *sk;
1838
1839         BT_DBG("sock %p", sock);
1840
1841         sock->state = SS_UNCONNECTED;
1842
1843         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1844             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1845                 return -ESOCKTNOSUPPORT;
1846
1847         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1848                 return -EPERM;
1849
1850         sock->ops = &l2cap_sock_ops;
1851
1852         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1853         if (!sk)
1854                 return -ENOMEM;
1855
1856         l2cap_sock_init(sk, NULL);
1857         bt_sock_link(&l2cap_sk_list, sk);
1858         return 0;
1859 }
1860
1861 static const struct proto_ops l2cap_sock_ops = {
1862         .family         = PF_BLUETOOTH,
1863         .owner          = THIS_MODULE,
1864         .release        = l2cap_sock_release,
1865         .bind           = l2cap_sock_bind,
1866         .connect        = l2cap_sock_connect,
1867         .listen         = l2cap_sock_listen,
1868         .accept         = l2cap_sock_accept,
1869         .getname        = l2cap_sock_getname,
1870         .sendmsg        = l2cap_sock_sendmsg,
1871         .recvmsg        = l2cap_sock_recvmsg,
1872         .poll           = bt_sock_poll,
1873         .ioctl          = bt_sock_ioctl,
1874         .gettstamp      = sock_gettstamp,
1875         .mmap           = sock_no_mmap,
1876         .socketpair     = sock_no_socketpair,
1877         .shutdown       = l2cap_sock_shutdown,
1878         .setsockopt     = l2cap_sock_setsockopt,
1879         .getsockopt     = l2cap_sock_getsockopt
1880 };
1881
1882 static const struct net_proto_family l2cap_sock_family_ops = {
1883         .family = PF_BLUETOOTH,
1884         .owner  = THIS_MODULE,
1885         .create = l2cap_sock_create,
1886 };
1887
1888 int __init l2cap_init_sockets(void)
1889 {
1890         int err;
1891
1892         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1893
1894         err = proto_register(&l2cap_proto, 0);
1895         if (err < 0)
1896                 return err;
1897
1898         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1899         if (err < 0) {
1900                 BT_ERR("L2CAP socket registration failed");
1901                 goto error;
1902         }
1903
1904         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1905                              NULL);
1906         if (err < 0) {
1907                 BT_ERR("Failed to create L2CAP proc file");
1908                 bt_sock_unregister(BTPROTO_L2CAP);
1909                 goto error;
1910         }
1911
1912         BT_INFO("L2CAP socket layer initialized");
1913
1914         return 0;
1915
1916 error:
1917         proto_unregister(&l2cap_proto);
1918         return err;
1919 }
1920
1921 void l2cap_cleanup_sockets(void)
1922 {
1923         bt_procfs_cleanup(&init_net, "l2cap");
1924         bt_sock_unregister(BTPROTO_L2CAP);
1925         proto_unregister(&l2cap_proto);
1926 }