net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/sched/signal.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/l2cap.h>
  37
  38 #include "smp.h"
  39
  40 static struct bt_sock_list l2cap_sk_list = {
  41         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  42 };
  43
  44 static const struct proto_ops l2cap_sock_ops;
  45 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  46 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  47                                      int proto, gfp_t prio, int kern);
  48 static void l2cap_sock_cleanup_listen(struct sock *parent);
  49
  50 bool l2cap_is_socket(struct socket *sock)
  51 {
  52         return sock && sock->ops == &l2cap_sock_ops;
  53 }
  54 EXPORT_SYMBOL(l2cap_is_socket);
  55
  56 static int l2cap_validate_bredr_psm(u16 psm)
  57 {
  58         /* PSM must be odd and lsb of upper byte must be 0 */
  59         if ((psm & 0x0101) != 0x0001)
  60                 return -EINVAL;
  61
  62         /* Restrict usage of well-known PSMs */
  63         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  64                 return -EACCES;
  65
  66         return 0;
  67 }
  68
  69 static int l2cap_validate_le_psm(u16 psm)
  70 {
  71         /* Valid LE_PSM ranges are defined only until 0x00ff */
  72         if (psm > L2CAP_PSM_LE_DYN_END)
  73                 return -EINVAL;
  74
  75         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  76         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  77                 return -EACCES;
  78
  79         return 0;
  80 }
  81
  82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  83 {
  84         struct sock *sk = sock->sk;
  85         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  86         struct sockaddr_l2 la;
  87         int len, err = 0;
  88
  89         BT_DBG("sk %p", sk);
  90
  91         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  92             addr->sa_family != AF_BLUETOOTH)
  93                 return -EINVAL;
  94
  95         memset(&la, 0, sizeof(la));
  96         len = min_t(unsigned int, sizeof(la), alen);
  97         memcpy(&la, addr, len);
  98
  99         if (la.l2_cid && la.l2_psm)
 100                 return -EINVAL;
 101
 102         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 103                 return -EINVAL;
 104
 105         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 106                 /* We only allow ATT user space socket */
 107                 if (la.l2_cid &&
 108                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 109                         return -EINVAL;
 110         }
 111
 112         lock_sock(sk);
 113
 114         if (sk->sk_state != BT_OPEN) {
 115                 err = -EBADFD;
 116                 goto done;
 117         }
 118
 119         if (la.l2_psm) {
 120                 __u16 psm = __le16_to_cpu(la.l2_psm);
 121
 122                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 123                         err = l2cap_validate_bredr_psm(psm);
 124                 else
 125                         err = l2cap_validate_le_psm(psm);
 126
 127                 if (err)
 128                         goto done;
 129         }
 130
 131         bacpy(&chan->src, &la.l2_bdaddr);
 132         chan->src_type = la.l2_bdaddr_type;
 133
 134         if (la.l2_cid)
 135                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 136         else
 137                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 138
 139         if (err < 0)
 140                 goto done;
 141
 142         switch (chan->chan_type) {
 143         case L2CAP_CHAN_CONN_LESS:
 144                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 145                         chan->sec_level = BT_SECURITY_SDP;
 146                 break;
 147         case L2CAP_CHAN_CONN_ORIENTED:
 148                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 149                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 150                         chan->sec_level = BT_SECURITY_SDP;
 151                 break;
 152         case L2CAP_CHAN_RAW:
 153                 chan->sec_level = BT_SECURITY_SDP;
 154                 break;
 155         case L2CAP_CHAN_FIXED:
 156                 /* Fixed channels default to the L2CAP core not holding a
 157                  * hci_conn reference for them. For fixed channels mapping to
 158                  * L2CAP sockets we do want to hold a reference so set the
 159                  * appropriate flag to request it.
 160                  */
 161                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 162                 break;
 163         }
 164
 165         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 166                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 167
 168         chan->state = BT_BOUND;
 169         sk->sk_state = BT_BOUND;
 170
 171 done:
 172         release_sock(sk);
 173         return err;
 174 }
 175
 176 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 177                               int alen, int flags)
 178 {
 179         struct sock *sk = sock->sk;
 180         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 181         struct sockaddr_l2 la;
 182         int len, err = 0;
 183         bool zapped;
 184
 185         BT_DBG("sk %p", sk);
 186
 187         lock_sock(sk);
 188         zapped = sock_flag(sk, SOCK_ZAPPED);
 189         release_sock(sk);
 190
 191         if (zapped)
 192                 return -EINVAL;
 193
 194         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 195             addr->sa_family != AF_BLUETOOTH)
 196                 return -EINVAL;
 197
 198         memset(&la, 0, sizeof(la));
 199         len = min_t(unsigned int, sizeof(la), alen);
 200         memcpy(&la, addr, len);
 201
 202         if (la.l2_cid && la.l2_psm)
 203                 return -EINVAL;
 204
 205         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 206                 return -EINVAL;
 207
 208         /* Check that the socket wasn't bound to something that
 209          * conflicts with the address given to connect(). If chan->src
 210          * is BDADDR_ANY it means bind() was never used, in which case
 211          * chan->src_type and la.l2_bdaddr_type do not need to match.
 212          */
 213         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 214             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 215                 /* Old user space versions will try to incorrectly bind
 216                  * the ATT socket using BDADDR_BREDR. We need to accept
 217                  * this and fix up the source address type only when
 218                  * both the source CID and destination CID indicate
 219                  * ATT. Anything else is an invalid combination.
 220                  */
 221                 if (chan->scid != L2CAP_CID_ATT ||
 222                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 223                         return -EINVAL;
 224
 225                 /* We don't have the hdev available here to make a
 226                  * better decision on random vs public, but since all
 227                  * user space versions that exhibit this issue anyway do
 228                  * not support random local addresses assuming public
 229                  * here is good enough.
 230                  */
 231                 chan->src_type = BDADDR_LE_PUBLIC;
 232         }
 233
 234         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 235                 return -EINVAL;
 236
 237         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 238                 /* We only allow ATT user space socket */
 239                 if (la.l2_cid &&
 240                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 241                         return -EINVAL;
 242         }
 243
 244         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 245                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 246
 247         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 248                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 249         if (err)
 250                 return err;
 251
 252         lock_sock(sk);
 253
 254         err = bt_sock_wait_state(sk, BT_CONNECTED,
 255                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 256
 257         release_sock(sk);
 258
 259         return err;
 260 }
 261
 262 static int l2cap_sock_listen(struct socket *sock, int backlog)
 263 {
 264         struct sock *sk = sock->sk;
 265         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 266         int err = 0;
 267
 268         BT_DBG("sk %p backlog %d", sk, backlog);
 269
 270         lock_sock(sk);
 271
 272         if (sk->sk_state != BT_BOUND) {
 273                 err = -EBADFD;
 274                 goto done;
 275         }
 276
 277         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 278                 err = -EINVAL;
 279                 goto done;
 280         }
 281
 282         switch (chan->mode) {
 283         case L2CAP_MODE_BASIC:
 284         case L2CAP_MODE_LE_FLOWCTL:
 285                 break;
 286         case L2CAP_MODE_ERTM:
 287         case L2CAP_MODE_STREAMING:
 288                 if (!disable_ertm)
 289                         break;
 290                 /* fall through */
 291         default:
 292                 err = -EOPNOTSUPP;
 293                 goto done;
 294         }
 295
 296         sk->sk_max_ack_backlog = backlog;
 297         sk->sk_ack_backlog = 0;
 298
 299         /* Listening channels need to use nested locking in order not to
 300          * cause lockdep warnings when the created child channels end up
 301          * being locked in the same thread as the parent channel.
 302          */
 303         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 304
 305         chan->state = BT_LISTEN;
 306         sk->sk_state = BT_LISTEN;
 307
 308 done:
 309         release_sock(sk);
 310         return err;
 311 }
 312
 313 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 314                              int flags, bool kern)
 315 {
 316         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 317         struct sock *sk = sock->sk, *nsk;
 318         long timeo;
 319         int err = 0;
 320
 321         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 322
 323         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 324
 325         BT_DBG("sk %p timeo %ld", sk, timeo);
 326
 327         /* Wait for an incoming connection. (wake-one). */
 328         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 329         while (1) {
 330                 if (sk->sk_state != BT_LISTEN) {
 331                         err = -EBADFD;
 332                         break;
 333                 }
 334
 335                 nsk = bt_accept_dequeue(sk, newsock);
 336                 if (nsk)
 337                         break;
 338
 339                 if (!timeo) {
 340                         err = -EAGAIN;
 341                         break;
 342                 }
 343
 344                 if (signal_pending(current)) {
 345                         err = sock_intr_errno(timeo);
 346                         break;
 347                 }
 348
 349                 release_sock(sk);
 350
 351                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 352
 353                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 354         }
 355         remove_wait_queue(sk_sleep(sk), &wait);
 356
 357         if (err)
 358                 goto done;
 359
 360         newsock->state = SS_CONNECTED;
 361
 362         BT_DBG("new socket %p", nsk);
 363
 364 done:
 365         release_sock(sk);
 366         return err;
 367 }
 368
 369 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 370                               int *len, int peer)
 371 {
 372         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 373         struct sock *sk = sock->sk;
 374         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 375
 376         BT_DBG("sock %p, sk %p", sock, sk);
 377
 378         if (peer && sk->sk_state != BT_CONNECTED &&
 379             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 380             sk->sk_state != BT_CONFIG)
 381                 return -ENOTCONN;
 382
 383         memset(la, 0, sizeof(struct sockaddr_l2));
 384         addr->sa_family = AF_BLUETOOTH;
 385         *len = sizeof(struct sockaddr_l2);
 386
 387         la->l2_psm = chan->psm;
 388
 389         if (peer) {
 390                 bacpy(&la->l2_bdaddr, &chan->dst);
 391                 la->l2_cid = cpu_to_le16(chan->dcid);
 392                 la->l2_bdaddr_type = chan->dst_type;
 393         } else {
 394                 bacpy(&la->l2_bdaddr, &chan->src);
 395                 la->l2_cid = cpu_to_le16(chan->scid);
 396                 la->l2_bdaddr_type = chan->src_type;
 397         }
 398
 399         return 0;
 400 }
 401
 402 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 403                                      char __user *optval, int __user *optlen)
 404 {
 405         struct sock *sk = sock->sk;
 406         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 407         struct l2cap_options opts;
 408         struct l2cap_conninfo cinfo;
 409         int len, err = 0;
 410         u32 opt;
 411
 412         BT_DBG("sk %p", sk);
 413
 414         if (get_user(len, optlen))
 415                 return -EFAULT;
 416
 417         lock_sock(sk);
 418
 419         switch (optname) {
 420         case L2CAP_OPTIONS:
 421                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 422                  * legacy ATT code depends on getsockopt for
 423                  * L2CAP_OPTIONS we need to let this pass.
 424                  */
 425                 if (bdaddr_type_is_le(chan->src_type) &&
 426                     chan->scid != L2CAP_CID_ATT) {
 427                         err = -EINVAL;
 428                         break;
 429                 }
 430
 431                 memset(&opts, 0, sizeof(opts));
 432                 opts.imtu     = chan->imtu;
 433                 opts.omtu     = chan->omtu;
 434                 opts.flush_to = chan->flush_to;
 435                 opts.mode     = chan->mode;
 436                 opts.fcs      = chan->fcs;
 437                 opts.max_tx   = chan->max_tx;
 438                 opts.txwin_size = chan->tx_win;
 439
 440                 len = min_t(unsigned int, len, sizeof(opts));
 441                 if (copy_to_user(optval, (char *) &opts, len))
 442                         err = -EFAULT;
 443
 444                 break;
 445
 446         case L2CAP_LM:
 447                 switch (chan->sec_level) {
 448                 case BT_SECURITY_LOW:
 449                         opt = L2CAP_LM_AUTH;
 450                         break;
 451                 case BT_SECURITY_MEDIUM:
 452                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 453                         break;
 454                 case BT_SECURITY_HIGH:
 455                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 456                               L2CAP_LM_SECURE;
 457                         break;
 458                 case BT_SECURITY_FIPS:
 459                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 460                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 461                         break;
 462                 default:
 463                         opt = 0;
 464                         break;
 465                 }
 466
 467                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 468                         opt |= L2CAP_LM_MASTER;
 469
 470                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 471                         opt |= L2CAP_LM_RELIABLE;
 472
 473                 if (put_user(opt, (u32 __user *) optval))
 474                         err = -EFAULT;
 475
 476                 break;
 477
 478         case L2CAP_CONNINFO:
 479                 if (sk->sk_state != BT_CONNECTED &&
 480                     !(sk->sk_state == BT_CONNECT2 &&
 481                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 482                         err = -ENOTCONN;
 483                         break;
 484                 }
 485
 486                 memset(&cinfo, 0, sizeof(cinfo));
 487                 cinfo.hci_handle = chan->conn->hcon->handle;
 488                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 489
 490                 len = min_t(unsigned int, len, sizeof(cinfo));
 491                 if (copy_to_user(optval, (char *) &cinfo, len))
 492                         err = -EFAULT;
 493
 494                 break;
 495
 496         default:
 497                 err = -ENOPROTOOPT;
 498                 break;
 499         }
 500
 501         release_sock(sk);
 502         return err;
 503 }
 504
 505 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 506                                  char __user *optval, int __user *optlen)
 507 {
 508         struct sock *sk = sock->sk;
 509         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 510         struct bt_security sec;
 511         struct bt_power pwr;
 512         int len, err = 0;
 513
 514         BT_DBG("sk %p", sk);
 515
 516         if (level == SOL_L2CAP)
 517                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 518
 519         if (level != SOL_BLUETOOTH)
 520                 return -ENOPROTOOPT;
 521
 522         if (get_user(len, optlen))
 523                 return -EFAULT;
 524
 525         lock_sock(sk);
 526
 527         switch (optname) {
 528         case BT_SECURITY:
 529                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 530                     chan->chan_type != L2CAP_CHAN_FIXED &&
 531                     chan->chan_type != L2CAP_CHAN_RAW) {
 532                         err = -EINVAL;
 533                         break;
 534                 }
 535
 536                 memset(&sec, 0, sizeof(sec));
 537                 if (chan->conn) {
 538                         sec.level = chan->conn->hcon->sec_level;
 539
 540                         if (sk->sk_state == BT_CONNECTED)
 541                                 sec.key_size = chan->conn->hcon->enc_key_size;
 542                 } else {
 543                         sec.level = chan->sec_level;
 544                 }
 545
 546                 len = min_t(unsigned int, len, sizeof(sec));
 547                 if (copy_to_user(optval, (char *) &sec, len))
 548                         err = -EFAULT;
 549
 550                 break;
 551
 552         case BT_DEFER_SETUP:
 553                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 554                         err = -EINVAL;
 555                         break;
 556                 }
 557
 558                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 559                              (u32 __user *) optval))
 560                         err = -EFAULT;
 561
 562                 break;
 563
 564         case BT_FLUSHABLE:
 565                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 566                              (u32 __user *) optval))
 567                         err = -EFAULT;
 568
 569                 break;
 570
 571         case BT_POWER:
 572                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 573                     && sk->sk_type != SOCK_RAW) {
 574                         err = -EINVAL;
 575                         break;
 576                 }
 577
 578                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 579
 580                 len = min_t(unsigned int, len, sizeof(pwr));
 581                 if (copy_to_user(optval, (char *) &pwr, len))
 582                         err = -EFAULT;
 583
 584                 break;
 585
 586         case BT_CHANNEL_POLICY:
 587                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 588                         err = -EFAULT;
 589                 break;
 590
 591         case BT_SNDMTU:
 592                 if (!bdaddr_type_is_le(chan->src_type)) {
 593                         err = -EINVAL;
 594                         break;
 595                 }
 596
 597                 if (sk->sk_state != BT_CONNECTED) {
 598                         err = -ENOTCONN;
 599                         break;
 600                 }
 601
 602                 if (put_user(chan->omtu, (u16 __user *) optval))
 603                         err = -EFAULT;
 604                 break;
 605
 606         case BT_RCVMTU:
 607                 if (!bdaddr_type_is_le(chan->src_type)) {
 608                         err = -EINVAL;
 609                         break;
 610                 }
 611
 612                 if (put_user(chan->imtu, (u16 __user *) optval))
 613                         err = -EFAULT;
 614                 break;
 615
 616         default:
 617                 err = -ENOPROTOOPT;
 618                 break;
 619         }
 620
 621         release_sock(sk);
 622         return err;
 623 }
 624
 625 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 626 {
 627         switch (chan->scid) {
 628         case L2CAP_CID_ATT:
 629                 if (mtu < L2CAP_LE_MIN_MTU)
 630                         return false;
 631                 break;
 632
 633         default:
 634                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 635                         return false;
 636         }
 637
 638         return true;
 639 }
 640
 641 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 642                                      char __user *optval, unsigned int optlen)
 643 {
 644         struct sock *sk = sock->sk;
 645         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 646         struct l2cap_options opts;
 647         int len, err = 0;
 648         u32 opt;
 649
 650         BT_DBG("sk %p", sk);
 651
 652         lock_sock(sk);
 653
 654         switch (optname) {
 655         case L2CAP_OPTIONS:
 656                 if (bdaddr_type_is_le(chan->src_type)) {
 657                         err = -EINVAL;
 658                         break;
 659                 }
 660
 661                 if (sk->sk_state == BT_CONNECTED) {
 662                         err = -EINVAL;
 663                         break;
 664                 }
 665
 666                 opts.imtu     = chan->imtu;
 667                 opts.omtu     = chan->omtu;
 668                 opts.flush_to = chan->flush_to;
 669                 opts.mode     = chan->mode;
 670                 opts.fcs      = chan->fcs;
 671                 opts.max_tx   = chan->max_tx;
 672                 opts.txwin_size = chan->tx_win;
 673
 674                 len = min_t(unsigned int, sizeof(opts), optlen);
 675                 if (copy_from_user((char *) &opts, optval, len)) {
 676                         err = -EFAULT;
 677                         break;
 678                 }
 679
 680                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 681                         err = -EINVAL;
 682                         break;
 683                 }
 684
 685                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 686                         err = -EINVAL;
 687                         break;
 688                 }
 689
 690                 chan->mode = opts.mode;
 691                 switch (chan->mode) {
 692                 case L2CAP_MODE_LE_FLOWCTL:
 693                         break;
 694                 case L2CAP_MODE_BASIC:
 695                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 696                         break;
 697                 case L2CAP_MODE_ERTM:
 698                 case L2CAP_MODE_STREAMING:
 699                         if (!disable_ertm)
 700                                 break;
 701                         /* fall through */
 702                 default:
 703                         err = -EINVAL;
 704                         break;
 705                 }
 706
 707                 chan->imtu = opts.imtu;
 708                 chan->omtu = opts.omtu;
 709                 chan->fcs  = opts.fcs;
 710                 chan->max_tx = opts.max_tx;
 711                 chan->tx_win = opts.txwin_size;
 712                 chan->flush_to = opts.flush_to;
 713                 break;
 714
 715         case L2CAP_LM:
 716                 if (get_user(opt, (u32 __user *) optval)) {
 717                         err = -EFAULT;
 718                         break;
 719                 }
 720
 721                 if (opt & L2CAP_LM_FIPS) {
 722                         err = -EINVAL;
 723                         break;
 724                 }
 725
 726                 if (opt & L2CAP_LM_AUTH)
 727                         chan->sec_level = BT_SECURITY_LOW;
 728                 if (opt & L2CAP_LM_ENCRYPT)
 729                         chan->sec_level = BT_SECURITY_MEDIUM;
 730                 if (opt & L2CAP_LM_SECURE)
 731                         chan->sec_level = BT_SECURITY_HIGH;
 732
 733                 if (opt & L2CAP_LM_MASTER)
 734                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 735                 else
 736                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 737
 738                 if (opt & L2CAP_LM_RELIABLE)
 739                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 740                 else
 741                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 742                 break;
 743
 744         default:
 745                 err = -ENOPROTOOPT;
 746                 break;
 747         }
 748
 749         release_sock(sk);
 750         return err;
 751 }
 752
 753 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 754                                  char __user *optval, unsigned int optlen)
 755 {
 756         struct sock *sk = sock->sk;
 757         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 758         struct bt_security sec;
 759         struct bt_power pwr;
 760         struct l2cap_conn *conn;
 761         int len, err = 0;
 762         u32 opt;
 763
 764         BT_DBG("sk %p", sk);
 765
 766         if (level == SOL_L2CAP)
 767                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 768
 769         if (level != SOL_BLUETOOTH)
 770                 return -ENOPROTOOPT;
 771
 772         lock_sock(sk);
 773
 774         switch (optname) {
 775         case BT_SECURITY:
 776                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 777                     chan->chan_type != L2CAP_CHAN_FIXED &&
 778                     chan->chan_type != L2CAP_CHAN_RAW) {
 779                         err = -EINVAL;
 780                         break;
 781                 }
 782
 783                 sec.level = BT_SECURITY_LOW;
 784
 785                 len = min_t(unsigned int, sizeof(sec), optlen);
 786                 if (copy_from_user((char *) &sec, optval, len)) {
 787                         err = -EFAULT;
 788                         break;
 789                 }
 790
 791                 if (sec.level < BT_SECURITY_LOW ||
 792                     sec.level > BT_SECURITY_FIPS) {
 793                         err = -EINVAL;
 794                         break;
 795                 }
 796
 797                 chan->sec_level = sec.level;
 798
 799                 if (!chan->conn)
 800                         break;
 801
 802                 conn = chan->conn;
 803
 804                 /*change security for LE channels */
 805                 if (chan->scid == L2CAP_CID_ATT) {
 806                         if (smp_conn_security(conn->hcon, sec.level))
 807                                 break;
 808                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 809                         sk->sk_state = BT_CONFIG;
 810                         chan->state = BT_CONFIG;
 811
 812                 /* or for ACL link */
 813                 } else if ((sk->sk_state == BT_CONNECT2 &&
 814                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 815                            sk->sk_state == BT_CONNECTED) {
 816                         if (!l2cap_chan_check_security(chan, true))
 817                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 818                         else
 819                                 sk->sk_state_change(sk);
 820                 } else {
 821                         err = -EINVAL;
 822                 }
 823                 break;
 824
 825         case BT_DEFER_SETUP:
 826                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 827                         err = -EINVAL;
 828                         break;
 829                 }
 830
 831                 if (get_user(opt, (u32 __user *) optval)) {
 832                         err = -EFAULT;
 833                         break;
 834                 }
 835
 836                 if (opt) {
 837                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 838                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 839                 } else {
 840                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 841                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 842                 }
 843                 break;
 844
 845         case BT_FLUSHABLE:
 846                 if (get_user(opt, (u32 __user *) optval)) {
 847                         err = -EFAULT;
 848                         break;
 849                 }
 850
 851                 if (opt > BT_FLUSHABLE_ON) {
 852                         err = -EINVAL;
 853                         break;
 854                 }
 855
 856                 if (opt == BT_FLUSHABLE_OFF) {
 857                         conn = chan->conn;
 858                         /* proceed further only when we have l2cap_conn and
 859                            No Flush support in the LM */
 860                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 861                                 err = -EINVAL;
 862                                 break;
 863                         }
 864                 }
 865
 866                 if (opt)
 867                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 868                 else
 869                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 870                 break;
 871
 872         case BT_POWER:
 873                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 874                     chan->chan_type != L2CAP_CHAN_RAW) {
 875                         err = -EINVAL;
 876                         break;
 877                 }
 878
 879                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 880
 881                 len = min_t(unsigned int, sizeof(pwr), optlen);
 882                 if (copy_from_user((char *) &pwr, optval, len)) {
 883                         err = -EFAULT;
 884                         break;
 885                 }
 886
 887                 if (pwr.force_active)
 888                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 889                 else
 890                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 891                 break;
 892
 893         case BT_CHANNEL_POLICY:
 894                 if (get_user(opt, (u32 __user *) optval)) {
 895                         err = -EFAULT;
 896                         break;
 897                 }
 898
 899                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 900                         err = -EINVAL;
 901                         break;
 902                 }
 903
 904                 if (chan->mode != L2CAP_MODE_ERTM &&
 905                     chan->mode != L2CAP_MODE_STREAMING) {
 906                         err = -EOPNOTSUPP;
 907                         break;
 908                 }
 909
 910                 chan->chan_policy = (u8) opt;
 911
 912                 if (sk->sk_state == BT_CONNECTED &&
 913                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 914                         l2cap_move_start(chan);
 915
 916                 break;
 917
 918         case BT_SNDMTU:
 919                 if (!bdaddr_type_is_le(chan->src_type)) {
 920                         err = -EINVAL;
 921                         break;
 922                 }
 923
 924                 /* Setting is not supported as it's the remote side that
 925                  * decides this.
 926                  */
 927                 err = -EPERM;
 928                 break;
 929
 930         case BT_RCVMTU:
 931                 if (!bdaddr_type_is_le(chan->src_type)) {
 932                         err = -EINVAL;
 933                         break;
 934                 }
 935
 936                 if (sk->sk_state == BT_CONNECTED) {
 937                         err = -EISCONN;
 938                         break;
 939                 }
 940
 941                 if (get_user(opt, (u16 __user *) optval)) {
 942                         err = -EFAULT;
 943                         break;
 944                 }
 945
 946                 chan->imtu = opt;
 947                 break;
 948
 949         default:
 950                 err = -ENOPROTOOPT;
 951                 break;
 952         }
 953
 954         release_sock(sk);
 955         return err;
 956 }
 957
 958 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 959                               size_t len)
 960 {
 961         struct sock *sk = sock->sk;
 962         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 963         int err;
 964
 965         BT_DBG("sock %p, sk %p", sock, sk);
 966
 967         err = sock_error(sk);
 968         if (err)
 969                 return err;
 970
 971         if (msg->msg_flags & MSG_OOB)
 972                 return -EOPNOTSUPP;
 973
 974         if (sk->sk_state != BT_CONNECTED)
 975                 return -ENOTCONN;
 976
 977         lock_sock(sk);
 978         err = bt_sock_wait_ready(sk, msg->msg_flags);
 979         release_sock(sk);
 980         if (err)
 981                 return err;
 982
 983         l2cap_chan_lock(chan);
 984         err = l2cap_chan_send(chan, msg, len);
 985         l2cap_chan_unlock(chan);
 986
 987         return err;
 988 }
 989
 990 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 991                               size_t len, int flags)
 992 {
 993         struct sock *sk = sock->sk;
 994         struct l2cap_pinfo *pi = l2cap_pi(sk);
 995         int err;
 996
 997         lock_sock(sk);
 998
 999         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1000                                                     &bt_sk(sk)->flags)) {
1001                 if (bdaddr_type_is_le(pi->chan->src_type)) {
1002                         sk->sk_state = BT_CONNECTED;
1003                         pi->chan->state = BT_CONNECTED;
1004                         __l2cap_le_connect_rsp_defer(pi->chan);
1005                 } else {
1006                         sk->sk_state = BT_CONFIG;
1007                         pi->chan->state = BT_CONFIG;
1008                         __l2cap_connect_rsp_defer(pi->chan);
1009                 }
1010
1011                 err = 0;
1012                 goto done;
1013         }
1014
1015         release_sock(sk);
1016
1017         if (sock->type == SOCK_STREAM)
1018                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1019         else
1020                 err = bt_sock_recvmsg(sock, msg, len, flags);
1021
1022         if (pi->chan->mode != L2CAP_MODE_ERTM)
1023                 return err;
1024
1025         /* Attempt to put pending rx data in the socket buffer */
1026
1027         lock_sock(sk);
1028
1029         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1030                 goto done;
1031
1032         if (pi->rx_busy_skb) {
1033                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1034                         pi->rx_busy_skb = NULL;
1035                 else
1036                         goto done;
1037         }
1038
1039         /* Restore data flow when half of the receive buffer is
1040          * available.  This avoids resending large numbers of
1041          * frames.
1042          */
1043         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1044                 l2cap_chan_busy(pi->chan, 0);
1045
1046 done:
1047         release_sock(sk);
1048         return err;
1049 }
1050
1051 /* Kill socket (only if zapped and orphan)
1052  * Must be called on unlocked socket, with l2cap channel lock.
1053  */
1054 static void l2cap_sock_kill(struct sock *sk)
1055 {
1056         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1057                 return;
1058
1059         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1060
1061         /* Kill poor orphan */
1062
1063         l2cap_chan_put(l2cap_pi(sk)->chan);
1064         sock_set_flag(sk, SOCK_DEAD);
1065         sock_put(sk);
1066 }
1067
1068 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1069 {
1070         DECLARE_WAITQUEUE(wait, current);
1071         int err = 0;
1072         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1073         /* Timeout to prevent infinite loop */
1074         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1075
1076         add_wait_queue(sk_sleep(sk), &wait);
1077         set_current_state(TASK_INTERRUPTIBLE);
1078         do {
1079                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1080                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1081                        jiffies_to_msecs(timeout - jiffies));
1082
1083                 if (!timeo)
1084                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1085
1086                 if (signal_pending(current)) {
1087                         err = sock_intr_errno(timeo);
1088                         break;
1089                 }
1090
1091                 release_sock(sk);
1092                 timeo = schedule_timeout(timeo);
1093                 lock_sock(sk);
1094                 set_current_state(TASK_INTERRUPTIBLE);
1095
1096                 err = sock_error(sk);
1097                 if (err)
1098                         break;
1099
1100                 if (time_after(jiffies, timeout)) {
1101                         err = -ENOLINK;
1102                         break;
1103                 }
1104
1105         } while (chan->unacked_frames > 0 &&
1106                  chan->state == BT_CONNECTED);
1107
1108         set_current_state(TASK_RUNNING);
1109         remove_wait_queue(sk_sleep(sk), &wait);
1110         return err;
1111 }
1112
1113 static int l2cap_sock_shutdown(struct socket *sock, int how)
1114 {
1115         struct sock *sk = sock->sk;
1116         struct l2cap_chan *chan;
1117         struct l2cap_conn *conn;
1118         int err = 0;
1119
1120         BT_DBG("sock %p, sk %p", sock, sk);
1121
1122         if (!sk)
1123                 return 0;
1124
1125         lock_sock(sk);
1126
1127         if (sk->sk_shutdown)
1128                 goto shutdown_already;
1129
1130         BT_DBG("Handling sock shutdown");
1131
1132         /* prevent sk structure from being freed whilst unlocked */
1133         sock_hold(sk);
1134
1135         chan = l2cap_pi(sk)->chan;
1136         /* prevent chan structure from being freed whilst unlocked */
1137         l2cap_chan_hold(chan);
1138
1139         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1140
1141         if (chan->mode == L2CAP_MODE_ERTM &&
1142             chan->unacked_frames > 0 &&
1143             chan->state == BT_CONNECTED) {
1144                 err = __l2cap_wait_ack(sk, chan);
1145
1146                 /* After waiting for ACKs, check whether shutdown
1147                  * has already been actioned to close the L2CAP
1148                  * link such as by l2cap_disconnection_req().
1149                  */
1150                 if (sk->sk_shutdown)
1151                         goto has_shutdown;
1152         }
1153
1154         sk->sk_shutdown = SHUTDOWN_MASK;
1155         release_sock(sk);
1156
1157         l2cap_chan_lock(chan);
1158         conn = chan->conn;
1159         if (conn)
1160                 /* prevent conn structure from being freed */
1161                 l2cap_conn_get(conn);
1162         l2cap_chan_unlock(chan);
1163
1164         if (conn)
1165                 /* mutex lock must be taken before l2cap_chan_lock() */
1166                 mutex_lock(&conn->chan_lock);
1167
1168         l2cap_chan_lock(chan);
1169         l2cap_chan_close(chan, 0);
1170         l2cap_chan_unlock(chan);
1171
1172         if (conn) {
1173                 mutex_unlock(&conn->chan_lock);
1174                 l2cap_conn_put(conn);
1175         }
1176
1177         lock_sock(sk);
1178
1179         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1180             !(current->flags & PF_EXITING))
1181                 err = bt_sock_wait_state(sk, BT_CLOSED,
1182                                          sk->sk_lingertime);
1183
1184 has_shutdown:
1185         l2cap_chan_put(chan);
1186         sock_put(sk);
1187
1188 shutdown_already:
1189         if (!err && sk->sk_err)
1190                 err = -sk->sk_err;
1191
1192         release_sock(sk);
1193
1194         BT_DBG("Sock shutdown complete err: %d", err);
1195
1196         return err;
1197 }
1198
1199 static int l2cap_sock_release(struct socket *sock)
1200 {
1201         struct sock *sk = sock->sk;
1202         int err;
1203         struct l2cap_chan *chan;
1204
1205         BT_DBG("sock %p, sk %p", sock, sk);
1206
1207         if (!sk)
1208                 return 0;
1209
1210         l2cap_sock_cleanup_listen(sk);
1211         bt_sock_unlink(&l2cap_sk_list, sk);
1212
1213         err = l2cap_sock_shutdown(sock, 2);
1214         chan = l2cap_pi(sk)->chan;
1215
1216         l2cap_chan_hold(chan);
1217         l2cap_chan_lock(chan);
1218
1219         sock_orphan(sk);
1220         l2cap_sock_kill(sk);
1221
1222         l2cap_chan_unlock(chan);
1223         l2cap_chan_put(chan);
1224
1225         return err;
1226 }
1227
1228 static void l2cap_sock_cleanup_listen(struct sock *parent)
1229 {
1230         struct sock *sk;
1231
1232         BT_DBG("parent %p state %s", parent,
1233                state_to_string(parent->sk_state));
1234
1235         /* Close not yet accepted channels */
1236         while ((sk = bt_accept_dequeue(parent, NULL))) {
1237                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1238
1239                 BT_DBG("child chan %p state %s", chan,
1240                        state_to_string(chan->state));
1241
1242                 l2cap_chan_hold(chan);
1243                 l2cap_chan_lock(chan);
1244
1245                 __clear_chan_timer(chan);
1246                 l2cap_chan_close(chan, ECONNRESET);
1247                 l2cap_sock_kill(sk);
1248
1249                 l2cap_chan_unlock(chan);
1250                 l2cap_chan_put(chan);
1251         }
1252 }
1253
1254 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1255 {
1256         struct sock *sk, *parent = chan->data;
1257
1258         lock_sock(parent);
1259
1260         /* Check for backlog size */
1261         if (sk_acceptq_is_full(parent)) {
1262                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1263                 release_sock(parent);
1264                 return NULL;
1265         }
1266
1267         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1268                               GFP_ATOMIC, 0);
1269         if (!sk) {
1270                 release_sock(parent);
1271                 return NULL;
1272         }
1273
1274         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1275
1276         l2cap_sock_init(sk, parent);
1277
1278         bt_accept_enqueue(parent, sk, false);
1279
1280         release_sock(parent);
1281
1282         return l2cap_pi(sk)->chan;
1283 }
1284
1285 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1286 {
1287         struct sock *sk = chan->data;
1288         int err;
1289
1290         lock_sock(sk);
1291
1292         if (l2cap_pi(sk)->rx_busy_skb) {
1293                 err = -ENOMEM;
1294                 goto done;
1295         }
1296
1297         if (chan->mode != L2CAP_MODE_ERTM &&
1298             chan->mode != L2CAP_MODE_STREAMING) {
1299                 /* Even if no filter is attached, we could potentially
1300                  * get errors from security modules, etc.
1301                  */
1302                 err = sk_filter(sk, skb);
1303                 if (err)
1304                         goto done;
1305         }
1306
1307         err = __sock_queue_rcv_skb(sk, skb);
1308
1309         /* For ERTM, handle one skb that doesn't fit into the recv
1310          * buffer.  This is important to do because the data frames
1311          * have already been acked, so the skb cannot be discarded.
1312          *
1313          * Notify the l2cap core that the buffer is full, so the
1314          * LOCAL_BUSY state is entered and no more frames are
1315          * acked and reassembled until there is buffer space
1316          * available.
1317          */
1318         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1319                 l2cap_pi(sk)->rx_busy_skb = skb;
1320                 l2cap_chan_busy(chan, 1);
1321                 err = 0;
1322         }
1323
1324 done:
1325         release_sock(sk);
1326
1327         return err;
1328 }
1329
1330 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1331 {
1332         struct sock *sk = chan->data;
1333
1334         if (!sk)
1335                 return;
1336
1337         l2cap_sock_kill(sk);
1338 }
1339
1340 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1341 {
1342         struct sock *sk = chan->data;
1343         struct sock *parent;
1344
1345         if (!sk)
1346                 return;
1347
1348         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1349
1350         /* This callback can be called both for server (BT_LISTEN)
1351          * sockets as well as "normal" ones. To avoid lockdep warnings
1352          * with child socket locking (through l2cap_sock_cleanup_listen)
1353          * we need separation into separate nesting levels. The simplest
1354          * way to accomplish this is to inherit the nesting level used
1355          * for the channel.
1356          */
1357         lock_sock_nested(sk, atomic_read(&chan->nesting));
1358
1359         parent = bt_sk(sk)->parent;
1360
1361         switch (chan->state) {
1362         case BT_OPEN:
1363         case BT_BOUND:
1364         case BT_CLOSED:
1365                 break;
1366         case BT_LISTEN:
1367                 l2cap_sock_cleanup_listen(sk);
1368                 sk->sk_state = BT_CLOSED;
1369                 chan->state = BT_CLOSED;
1370
1371                 break;
1372         default:
1373                 sk->sk_state = BT_CLOSED;
1374                 chan->state = BT_CLOSED;
1375
1376                 sk->sk_err = err;
1377
1378                 if (parent) {
1379                         bt_accept_unlink(sk);
1380                         parent->sk_data_ready(parent);
1381                 } else {
1382                         sk->sk_state_change(sk);
1383                 }
1384
1385                 break;
1386         }
1387         release_sock(sk);
1388
1389         /* Only zap after cleanup to avoid use after free race */
1390         sock_set_flag(sk, SOCK_ZAPPED);
1391
1392 }
1393
1394 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1395                                        int err)
1396 {
1397         struct sock *sk = chan->data;
1398
1399         sk->sk_state = state;
1400
1401         if (err)
1402                 sk->sk_err = err;
1403 }
1404
1405 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1406                                                unsigned long hdr_len,
1407                                                unsigned long len, int nb)
1408 {
1409         struct sock *sk = chan->data;
1410         struct sk_buff *skb;
1411         int err;
1412
1413         l2cap_chan_unlock(chan);
1414         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1415         l2cap_chan_lock(chan);
1416
1417         if (!skb)
1418                 return ERR_PTR(err);
1419
1420         /* Channel lock is released before requesting new skb and then
1421          * reacquired thus we need to recheck channel state.
1422          */
1423         if (chan->state != BT_CONNECTED) {
1424                 kfree_skb(skb);
1425                 return ERR_PTR(-ENOTCONN);
1426         }
1427
1428         skb->priority = sk->sk_priority;
1429
1430         bt_cb(skb)->l2cap.chan = chan;
1431
1432         return skb;
1433 }
1434
1435 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1436 {
1437         struct sock *sk = chan->data;
1438         struct sock *parent;
1439
1440         lock_sock(sk);
1441
1442         parent = bt_sk(sk)->parent;
1443
1444         BT_DBG("sk %p, parent %p", sk, parent);
1445
1446         sk->sk_state = BT_CONNECTED;
1447         sk->sk_state_change(sk);
1448
1449         if (parent)
1450                 parent->sk_data_ready(parent);
1451
1452         release_sock(sk);
1453 }
1454
1455 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1456 {
1457         struct sock *parent, *sk = chan->data;
1458
1459         lock_sock(sk);
1460
1461         parent = bt_sk(sk)->parent;
1462         if (parent)
1463                 parent->sk_data_ready(parent);
1464
1465         release_sock(sk);
1466 }
1467
1468 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1469 {
1470         struct sock *sk = chan->data;
1471
1472         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1473                 sk->sk_state = BT_CONNECTED;
1474                 chan->state = BT_CONNECTED;
1475         }
1476
1477         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1478         sk->sk_state_change(sk);
1479 }
1480
1481 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1482 {
1483         struct sock *sk = chan->data;
1484
1485         lock_sock(sk);
1486         sk->sk_shutdown = SHUTDOWN_MASK;
1487         release_sock(sk);
1488 }
1489
1490 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1491 {
1492         struct sock *sk = chan->data;
1493
1494         return sk->sk_sndtimeo;
1495 }
1496
1497 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1498 {
1499         struct sock *sk = chan->data;
1500
1501         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1502         sk->sk_state_change(sk);
1503 }
1504
1505 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1506 {
1507         struct sock *sk = chan->data;
1508
1509         switch (chan->mode) {
1510         case L2CAP_MODE_ERTM:
1511         case L2CAP_MODE_STREAMING:
1512                 return sk_filter(sk, skb);
1513         }
1514
1515         return 0;
1516 }
1517
1518 static const struct l2cap_ops l2cap_chan_ops = {
1519         .name                   = "L2CAP Socket Interface",
1520         .new_connection         = l2cap_sock_new_connection_cb,
1521         .recv                   = l2cap_sock_recv_cb,
1522         .close                  = l2cap_sock_close_cb,
1523         .teardown               = l2cap_sock_teardown_cb,
1524         .state_change           = l2cap_sock_state_change_cb,
1525         .ready                  = l2cap_sock_ready_cb,
1526         .defer                  = l2cap_sock_defer_cb,
1527         .resume                 = l2cap_sock_resume_cb,
1528         .suspend                = l2cap_sock_suspend_cb,
1529         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1530         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1531         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1532         .filter                 = l2cap_sock_filter,
1533 };
1534
1535 static void l2cap_sock_destruct(struct sock *sk)
1536 {
1537         BT_DBG("sk %p", sk);
1538
1539         if (l2cap_pi(sk)->chan) {
1540                 l2cap_pi(sk)->chan->data = NULL;
1541                 l2cap_chan_put(l2cap_pi(sk)->chan);
1542         }
1543
1544         if (l2cap_pi(sk)->rx_busy_skb) {
1545                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1546                 l2cap_pi(sk)->rx_busy_skb = NULL;
1547         }
1548
1549         skb_queue_purge(&sk->sk_receive_queue);
1550         skb_queue_purge(&sk->sk_write_queue);
1551 }
1552
1553 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1554                                int *msg_namelen)
1555 {
1556         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1557
1558         memset(la, 0, sizeof(struct sockaddr_l2));
1559         la->l2_family = AF_BLUETOOTH;
1560         la->l2_psm = bt_cb(skb)->l2cap.psm;
1561         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1562
1563         *msg_namelen = sizeof(struct sockaddr_l2);
1564 }
1565
1566 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1567 {
1568         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1569
1570         BT_DBG("sk %p", sk);
1571
1572         if (parent) {
1573                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1574
1575                 sk->sk_type = parent->sk_type;
1576                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1577
1578                 chan->chan_type = pchan->chan_type;
1579                 chan->imtu = pchan->imtu;
1580                 chan->omtu = pchan->omtu;
1581                 chan->conf_state = pchan->conf_state;
1582                 chan->mode = pchan->mode;
1583                 chan->fcs  = pchan->fcs;
1584                 chan->max_tx = pchan->max_tx;
1585                 chan->tx_win = pchan->tx_win;
1586                 chan->tx_win_max = pchan->tx_win_max;
1587                 chan->sec_level = pchan->sec_level;
1588                 chan->flags = pchan->flags;
1589                 chan->tx_credits = pchan->tx_credits;
1590                 chan->rx_credits = pchan->rx_credits;
1591
1592                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1593                         chan->scid = pchan->scid;
1594                         chan->dcid = pchan->scid;
1595                 }
1596
1597                 security_sk_clone(parent, sk);
1598         } else {
1599                 switch (sk->sk_type) {
1600                 case SOCK_RAW:
1601                         chan->chan_type = L2CAP_CHAN_RAW;
1602                         break;
1603                 case SOCK_DGRAM:
1604                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1605                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1606                         break;
1607                 case SOCK_SEQPACKET:
1608                 case SOCK_STREAM:
1609                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1610                         break;
1611                 }
1612
1613                 chan->imtu = L2CAP_DEFAULT_MTU;
1614                 chan->omtu = 0;
1615                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1616                         chan->mode = L2CAP_MODE_ERTM;
1617                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1618                 } else {
1619                         chan->mode = L2CAP_MODE_BASIC;
1620                 }
1621
1622                 l2cap_chan_set_defaults(chan);
1623         }
1624
1625         /* Default config options */
1626         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1627
1628         chan->data = sk;
1629         chan->ops = &l2cap_chan_ops;
1630 }
1631
1632 static struct proto l2cap_proto = {
1633         .name           = "L2CAP",
1634         .owner          = THIS_MODULE,
1635         .obj_size       = sizeof(struct l2cap_pinfo)
1636 };
1637
1638 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1639                                      int proto, gfp_t prio, int kern)
1640 {
1641         struct sock *sk;
1642         struct l2cap_chan *chan;
1643
1644         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1645         if (!sk)
1646                 return NULL;
1647
1648         sock_init_data(sock, sk);
1649         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1650
1651         sk->sk_destruct = l2cap_sock_destruct;
1652         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1653
1654         sock_reset_flag(sk, SOCK_ZAPPED);
1655
1656         sk->sk_protocol = proto;
1657         sk->sk_state = BT_OPEN;
1658
1659         chan = l2cap_chan_create();
1660         if (!chan) {
1661                 sk_free(sk);
1662                 return NULL;
1663         }
1664
1665         l2cap_chan_hold(chan);
1666
1667         l2cap_pi(sk)->chan = chan;
1668
1669         return sk;
1670 }
1671
1672 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1673                              int kern)
1674 {
1675         struct sock *sk;
1676
1677         BT_DBG("sock %p", sock);
1678
1679         sock->state = SS_UNCONNECTED;
1680
1681         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1682             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1683                 return -ESOCKTNOSUPPORT;
1684
1685         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1686                 return -EPERM;
1687
1688         sock->ops = &l2cap_sock_ops;
1689
1690         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1691         if (!sk)
1692                 return -ENOMEM;
1693
1694         l2cap_sock_init(sk, NULL);
1695         bt_sock_link(&l2cap_sk_list, sk);
1696         return 0;
1697 }
1698
1699 static const struct proto_ops l2cap_sock_ops = {
1700         .family         = PF_BLUETOOTH,
1701         .owner          = THIS_MODULE,
1702         .release        = l2cap_sock_release,
1703         .bind           = l2cap_sock_bind,
1704         .connect        = l2cap_sock_connect,
1705         .listen         = l2cap_sock_listen,
1706         .accept         = l2cap_sock_accept,
1707         .getname        = l2cap_sock_getname,
1708         .sendmsg        = l2cap_sock_sendmsg,
1709         .recvmsg        = l2cap_sock_recvmsg,
1710         .poll           = bt_sock_poll,
1711         .ioctl          = bt_sock_ioctl,
1712         .mmap           = sock_no_mmap,
1713         .socketpair     = sock_no_socketpair,
1714         .shutdown       = l2cap_sock_shutdown,
1715         .setsockopt     = l2cap_sock_setsockopt,
1716         .getsockopt     = l2cap_sock_getsockopt
1717 };
1718
1719 static const struct net_proto_family l2cap_sock_family_ops = {
1720         .family = PF_BLUETOOTH,
1721         .owner  = THIS_MODULE,
1722         .create = l2cap_sock_create,
1723 };
1724
1725 int __init l2cap_init_sockets(void)
1726 {
1727         int err;
1728
1729         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1730
1731         err = proto_register(&l2cap_proto, 0);
1732         if (err < 0)
1733                 return err;
1734
1735         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1736         if (err < 0) {
1737                 BT_ERR("L2CAP socket registration failed");
1738                 goto error;
1739         }
1740
1741         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1742                              NULL);
1743         if (err < 0) {
1744                 BT_ERR("Failed to create L2CAP proc file");
1745                 bt_sock_unregister(BTPROTO_L2CAP);
1746                 goto error;
1747         }
1748
1749         BT_INFO("L2CAP socket layer initialized");
1750
1751         return 0;
1752
1753 error:
1754         proto_unregister(&l2cap_proto);
1755         return err;
1756 }
1757
1758 void l2cap_cleanup_sockets(void)
1759 {
1760         bt_procfs_cleanup(&init_net, "l2cap");
1761         bt_sock_unregister(BTPROTO_L2CAP);
1762         proto_unregister(&l2cap_proto);
1763 }