net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/sched/signal.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/l2cap.h>
  37
  38 #include "smp.h"
  39
  40 static struct bt_sock_list l2cap_sk_list = {
  41         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  42 };
  43
  44 static const struct proto_ops l2cap_sock_ops;
  45 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  46 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  47                                      int proto, gfp_t prio, int kern);
  48 static void l2cap_sock_cleanup_listen(struct sock *parent);
  49
  50 bool l2cap_is_socket(struct socket *sock)
  51 {
  52         return sock && sock->ops == &l2cap_sock_ops;
  53 }
  54 EXPORT_SYMBOL(l2cap_is_socket);
  55
  56 static int l2cap_validate_bredr_psm(u16 psm)
  57 {
  58         /* PSM must be odd and lsb of upper byte must be 0 */
  59         if ((psm & 0x0101) != 0x0001)
  60                 return -EINVAL;
  61
  62         /* Restrict usage of well-known PSMs */
  63         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  64                 return -EACCES;
  65
  66         return 0;
  67 }
  68
  69 static int l2cap_validate_le_psm(u16 psm)
  70 {
  71         /* Valid LE_PSM ranges are defined only until 0x00ff */
  72         if (psm > L2CAP_PSM_LE_DYN_END)
  73                 return -EINVAL;
  74
  75         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  76         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  77                 return -EACCES;
  78
  79         return 0;
  80 }
  81
  82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  83 {
  84         struct sock *sk = sock->sk;
  85         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  86         struct sockaddr_l2 la;
  87         int len, err = 0;
  88
  89         BT_DBG("sk %p", sk);
  90
  91         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  92             addr->sa_family != AF_BLUETOOTH)
  93                 return -EINVAL;
  94
  95         memset(&la, 0, sizeof(la));
  96         len = min_t(unsigned int, sizeof(la), alen);
  97         memcpy(&la, addr, len);
  98
  99         if (la.l2_cid && la.l2_psm)
 100                 return -EINVAL;
 101
 102         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 103                 return -EINVAL;
 104
 105         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 106                 /* We only allow ATT user space socket */
 107                 if (la.l2_cid &&
 108                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 109                         return -EINVAL;
 110         }
 111
 112         lock_sock(sk);
 113
 114         if (sk->sk_state != BT_OPEN) {
 115                 err = -EBADFD;
 116                 goto done;
 117         }
 118
 119         if (la.l2_psm) {
 120                 __u16 psm = __le16_to_cpu(la.l2_psm);
 121
 122                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 123                         err = l2cap_validate_bredr_psm(psm);
 124                 else
 125                         err = l2cap_validate_le_psm(psm);
 126
 127                 if (err)
 128                         goto done;
 129         }
 130
 131         bacpy(&chan->src, &la.l2_bdaddr);
 132         chan->src_type = la.l2_bdaddr_type;
 133
 134         if (la.l2_cid)
 135                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 136         else
 137                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 138
 139         if (err < 0)
 140                 goto done;
 141
 142         switch (chan->chan_type) {
 143         case L2CAP_CHAN_CONN_LESS:
 144                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 145                         chan->sec_level = BT_SECURITY_SDP;
 146                 break;
 147         case L2CAP_CHAN_CONN_ORIENTED:
 148                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 149                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 150                         chan->sec_level = BT_SECURITY_SDP;
 151                 break;
 152         case L2CAP_CHAN_RAW:
 153                 chan->sec_level = BT_SECURITY_SDP;
 154                 break;
 155         case L2CAP_CHAN_FIXED:
 156                 /* Fixed channels default to the L2CAP core not holding a
 157                  * hci_conn reference for them. For fixed channels mapping to
 158                  * L2CAP sockets we do want to hold a reference so set the
 159                  * appropriate flag to request it.
 160                  */
 161                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 162                 break;
 163         }
 164
 165         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 166          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 167          */
 168         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 169             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 170                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 171
 172         chan->state = BT_BOUND;
 173         sk->sk_state = BT_BOUND;
 174
 175 done:
 176         release_sock(sk);
 177         return err;
 178 }
 179
 180 static void l2cap_sock_init_pid(struct sock *sk)
 181 {
 182         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 183
 184         /* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to
 185          * group the channels being requested.
 186          */
 187         if (chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 188                 return;
 189
 190         spin_lock(&sk->sk_peer_lock);
 191         sk->sk_peer_pid = get_pid(task_tgid(current));
 192         spin_unlock(&sk->sk_peer_lock);
 193 }
 194
 195 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 196                               int alen, int flags)
 197 {
 198         struct sock *sk = sock->sk;
 199         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 200         struct sockaddr_l2 la;
 201         int len, err = 0;
 202         bool zapped;
 203
 204         BT_DBG("sk %p", sk);
 205
 206         lock_sock(sk);
 207         zapped = sock_flag(sk, SOCK_ZAPPED);
 208         release_sock(sk);
 209
 210         if (zapped)
 211                 return -EINVAL;
 212
 213         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 214             addr->sa_family != AF_BLUETOOTH)
 215                 return -EINVAL;
 216
 217         memset(&la, 0, sizeof(la));
 218         len = min_t(unsigned int, sizeof(la), alen);
 219         memcpy(&la, addr, len);
 220
 221         if (la.l2_cid && la.l2_psm)
 222                 return -EINVAL;
 223
 224         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 225                 return -EINVAL;
 226
 227         /* Check that the socket wasn't bound to something that
 228          * conflicts with the address given to connect(). If chan->src
 229          * is BDADDR_ANY it means bind() was never used, in which case
 230          * chan->src_type and la.l2_bdaddr_type do not need to match.
 231          */
 232         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 233             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 234                 /* Old user space versions will try to incorrectly bind
 235                  * the ATT socket using BDADDR_BREDR. We need to accept
 236                  * this and fix up the source address type only when
 237                  * both the source CID and destination CID indicate
 238                  * ATT. Anything else is an invalid combination.
 239                  */
 240                 if (chan->scid != L2CAP_CID_ATT ||
 241                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 242                         return -EINVAL;
 243
 244                 /* We don't have the hdev available here to make a
 245                  * better decision on random vs public, but since all
 246                  * user space versions that exhibit this issue anyway do
 247                  * not support random local addresses assuming public
 248                  * here is good enough.
 249                  */
 250                 chan->src_type = BDADDR_LE_PUBLIC;
 251         }
 252
 253         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 254                 return -EINVAL;
 255
 256         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 257                 /* We only allow ATT user space socket */
 258                 if (la.l2_cid &&
 259                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 260                         return -EINVAL;
 261         }
 262
 263         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 264          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 265          */
 266         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 267             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 268                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 269
 270         l2cap_sock_init_pid(sk);
 271
 272         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 273                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 274         if (err)
 275                 return err;
 276
 277         lock_sock(sk);
 278
 279         err = bt_sock_wait_state(sk, BT_CONNECTED,
 280                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 281
 282         release_sock(sk);
 283
 284         return err;
 285 }
 286
 287 static int l2cap_sock_listen(struct socket *sock, int backlog)
 288 {
 289         struct sock *sk = sock->sk;
 290         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 291         int err = 0;
 292
 293         BT_DBG("sk %p backlog %d", sk, backlog);
 294
 295         lock_sock(sk);
 296
 297         if (sk->sk_state != BT_BOUND) {
 298                 err = -EBADFD;
 299                 goto done;
 300         }
 301
 302         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 303                 err = -EINVAL;
 304                 goto done;
 305         }
 306
 307         switch (chan->mode) {
 308         case L2CAP_MODE_BASIC:
 309         case L2CAP_MODE_LE_FLOWCTL:
 310                 break;
 311         case L2CAP_MODE_EXT_FLOWCTL:
 312                 if (!enable_ecred) {
 313                         err = -EOPNOTSUPP;
 314                         goto done;
 315                 }
 316                 break;
 317         case L2CAP_MODE_ERTM:
 318         case L2CAP_MODE_STREAMING:
 319                 if (!disable_ertm)
 320                         break;
 321                 fallthrough;
 322         default:
 323                 err = -EOPNOTSUPP;
 324                 goto done;
 325         }
 326
 327         l2cap_sock_init_pid(sk);
 328
 329         sk->sk_max_ack_backlog = backlog;
 330         sk->sk_ack_backlog = 0;
 331
 332         /* Listening channels need to use nested locking in order not to
 333          * cause lockdep warnings when the created child channels end up
 334          * being locked in the same thread as the parent channel.
 335          */
 336         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 337
 338         chan->state = BT_LISTEN;
 339         sk->sk_state = BT_LISTEN;
 340
 341 done:
 342         release_sock(sk);
 343         return err;
 344 }
 345
 346 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 347                              int flags, bool kern)
 348 {
 349         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 350         struct sock *sk = sock->sk, *nsk;
 351         long timeo;
 352         int err = 0;
 353
 354         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 355
 356         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 357
 358         BT_DBG("sk %p timeo %ld", sk, timeo);
 359
 360         /* Wait for an incoming connection. (wake-one). */
 361         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 362         while (1) {
 363                 if (sk->sk_state != BT_LISTEN) {
 364                         err = -EBADFD;
 365                         break;
 366                 }
 367
 368                 nsk = bt_accept_dequeue(sk, newsock);
 369                 if (nsk)
 370                         break;
 371
 372                 if (!timeo) {
 373                         err = -EAGAIN;
 374                         break;
 375                 }
 376
 377                 if (signal_pending(current)) {
 378                         err = sock_intr_errno(timeo);
 379                         break;
 380                 }
 381
 382                 release_sock(sk);
 383
 384                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 385
 386                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 387         }
 388         remove_wait_queue(sk_sleep(sk), &wait);
 389
 390         if (err)
 391                 goto done;
 392
 393         newsock->state = SS_CONNECTED;
 394
 395         BT_DBG("new socket %p", nsk);
 396
 397 done:
 398         release_sock(sk);
 399         return err;
 400 }
 401
 402 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 403                               int peer)
 404 {
 405         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 406         struct sock *sk = sock->sk;
 407         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 408
 409         BT_DBG("sock %p, sk %p", sock, sk);
 410
 411         if (peer && sk->sk_state != BT_CONNECTED &&
 412             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 413             sk->sk_state != BT_CONFIG)
 414                 return -ENOTCONN;
 415
 416         memset(la, 0, sizeof(struct sockaddr_l2));
 417         addr->sa_family = AF_BLUETOOTH;
 418
 419         la->l2_psm = chan->psm;
 420
 421         if (peer) {
 422                 bacpy(&la->l2_bdaddr, &chan->dst);
 423                 la->l2_cid = cpu_to_le16(chan->dcid);
 424                 la->l2_bdaddr_type = chan->dst_type;
 425         } else {
 426                 bacpy(&la->l2_bdaddr, &chan->src);
 427                 la->l2_cid = cpu_to_le16(chan->scid);
 428                 la->l2_bdaddr_type = chan->src_type;
 429         }
 430
 431         return sizeof(struct sockaddr_l2);
 432 }
 433
 434 static int l2cap_get_mode(struct l2cap_chan *chan)
 435 {
 436         switch (chan->mode) {
 437         case L2CAP_MODE_BASIC:
 438                 return BT_MODE_BASIC;
 439         case L2CAP_MODE_ERTM:
 440                 return BT_MODE_ERTM;
 441         case L2CAP_MODE_STREAMING:
 442                 return BT_MODE_STREAMING;
 443         case L2CAP_MODE_LE_FLOWCTL:
 444                 return BT_MODE_LE_FLOWCTL;
 445         case L2CAP_MODE_EXT_FLOWCTL:
 446                 return BT_MODE_EXT_FLOWCTL;
 447         }
 448
 449         return -EINVAL;
 450 }
 451
 452 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 453                                      char __user *optval, int __user *optlen)
 454 {
 455         struct sock *sk = sock->sk;
 456         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 457         struct l2cap_options opts;
 458         struct l2cap_conninfo cinfo;
 459         int len, err = 0;
 460         u32 opt;
 461
 462         BT_DBG("sk %p", sk);
 463
 464         if (get_user(len, optlen))
 465                 return -EFAULT;
 466
 467         lock_sock(sk);
 468
 469         switch (optname) {
 470         case L2CAP_OPTIONS:
 471                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 472                  * legacy ATT code depends on getsockopt for
 473                  * L2CAP_OPTIONS we need to let this pass.
 474                  */
 475                 if (bdaddr_type_is_le(chan->src_type) &&
 476                     chan->scid != L2CAP_CID_ATT) {
 477                         err = -EINVAL;
 478                         break;
 479                 }
 480
 481                 /* Only BR/EDR modes are supported here */
 482                 switch (chan->mode) {
 483                 case L2CAP_MODE_BASIC:
 484                 case L2CAP_MODE_ERTM:
 485                 case L2CAP_MODE_STREAMING:
 486                         break;
 487                 default:
 488                         err = -EINVAL;
 489                         break;
 490                 }
 491
 492                 if (err < 0)
 493                         break;
 494
 495                 memset(&opts, 0, sizeof(opts));
 496                 opts.imtu     = chan->imtu;
 497                 opts.omtu     = chan->omtu;
 498                 opts.flush_to = chan->flush_to;
 499                 opts.mode     = chan->mode;
 500                 opts.fcs      = chan->fcs;
 501                 opts.max_tx   = chan->max_tx;
 502                 opts.txwin_size = chan->tx_win;
 503
 504                 BT_DBG("mode 0x%2.2x", chan->mode);
 505
 506                 len = min_t(unsigned int, len, sizeof(opts));
 507                 if (copy_to_user(optval, (char *) &opts, len))
 508                         err = -EFAULT;
 509
 510                 break;
 511
 512         case L2CAP_LM:
 513                 switch (chan->sec_level) {
 514                 case BT_SECURITY_LOW:
 515                         opt = L2CAP_LM_AUTH;
 516                         break;
 517                 case BT_SECURITY_MEDIUM:
 518                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 519                         break;
 520                 case BT_SECURITY_HIGH:
 521                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 522                               L2CAP_LM_SECURE;
 523                         break;
 524                 case BT_SECURITY_FIPS:
 525                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 526                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 527                         break;
 528                 default:
 529                         opt = 0;
 530                         break;
 531                 }
 532
 533                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 534                         opt |= L2CAP_LM_MASTER;
 535
 536                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 537                         opt |= L2CAP_LM_RELIABLE;
 538
 539                 if (put_user(opt, (u32 __user *) optval))
 540                         err = -EFAULT;
 541
 542                 break;
 543
 544         case L2CAP_CONNINFO:
 545                 if (sk->sk_state != BT_CONNECTED &&
 546                     !(sk->sk_state == BT_CONNECT2 &&
 547                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 548                         err = -ENOTCONN;
 549                         break;
 550                 }
 551
 552                 memset(&cinfo, 0, sizeof(cinfo));
 553                 cinfo.hci_handle = chan->conn->hcon->handle;
 554                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 555
 556                 len = min_t(unsigned int, len, sizeof(cinfo));
 557                 if (copy_to_user(optval, (char *) &cinfo, len))
 558                         err = -EFAULT;
 559
 560                 break;
 561
 562         default:
 563                 err = -ENOPROTOOPT;
 564                 break;
 565         }
 566
 567         release_sock(sk);
 568         return err;
 569 }
 570
 571 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 572                                  char __user *optval, int __user *optlen)
 573 {
 574         struct sock *sk = sock->sk;
 575         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 576         struct bt_security sec;
 577         struct bt_power pwr;
 578         u32 phys;
 579         int len, mode, err = 0;
 580
 581         BT_DBG("sk %p", sk);
 582
 583         if (level == SOL_L2CAP)
 584                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 585
 586         if (level != SOL_BLUETOOTH)
 587                 return -ENOPROTOOPT;
 588
 589         if (get_user(len, optlen))
 590                 return -EFAULT;
 591
 592         lock_sock(sk);
 593
 594         switch (optname) {
 595         case BT_SECURITY:
 596                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 597                     chan->chan_type != L2CAP_CHAN_FIXED &&
 598                     chan->chan_type != L2CAP_CHAN_RAW) {
 599                         err = -EINVAL;
 600                         break;
 601                 }
 602
 603                 memset(&sec, 0, sizeof(sec));
 604                 if (chan->conn) {
 605                         sec.level = chan->conn->hcon->sec_level;
 606
 607                         if (sk->sk_state == BT_CONNECTED)
 608                                 sec.key_size = chan->conn->hcon->enc_key_size;
 609                 } else {
 610                         sec.level = chan->sec_level;
 611                 }
 612
 613                 len = min_t(unsigned int, len, sizeof(sec));
 614                 if (copy_to_user(optval, (char *) &sec, len))
 615                         err = -EFAULT;
 616
 617                 break;
 618
 619         case BT_DEFER_SETUP:
 620                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 621                         err = -EINVAL;
 622                         break;
 623                 }
 624
 625                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 626                              (u32 __user *) optval))
 627                         err = -EFAULT;
 628
 629                 break;
 630
 631         case BT_FLUSHABLE:
 632                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 633                              (u32 __user *) optval))
 634                         err = -EFAULT;
 635
 636                 break;
 637
 638         case BT_POWER:
 639                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 640                     && sk->sk_type != SOCK_RAW) {
 641                         err = -EINVAL;
 642                         break;
 643                 }
 644
 645                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 646
 647                 len = min_t(unsigned int, len, sizeof(pwr));
 648                 if (copy_to_user(optval, (char *) &pwr, len))
 649                         err = -EFAULT;
 650
 651                 break;
 652
 653         case BT_CHANNEL_POLICY:
 654                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 655                         err = -EFAULT;
 656                 break;
 657
 658         case BT_SNDMTU:
 659                 if (!bdaddr_type_is_le(chan->src_type)) {
 660                         err = -EINVAL;
 661                         break;
 662                 }
 663
 664                 if (sk->sk_state != BT_CONNECTED) {
 665                         err = -ENOTCONN;
 666                         break;
 667                 }
 668
 669                 if (put_user(chan->omtu, (u16 __user *) optval))
 670                         err = -EFAULT;
 671                 break;
 672
 673         case BT_RCVMTU:
 674                 if (!bdaddr_type_is_le(chan->src_type)) {
 675                         err = -EINVAL;
 676                         break;
 677                 }
 678
 679                 if (put_user(chan->imtu, (u16 __user *) optval))
 680                         err = -EFAULT;
 681                 break;
 682
 683         case BT_PHY:
 684                 if (sk->sk_state != BT_CONNECTED) {
 685                         err = -ENOTCONN;
 686                         break;
 687                 }
 688
 689                 phys = hci_conn_get_phy(chan->conn->hcon);
 690
 691                 if (put_user(phys, (u32 __user *) optval))
 692                         err = -EFAULT;
 693                 break;
 694
 695         case BT_MODE:
 696                 if (!enable_ecred) {
 697                         err = -ENOPROTOOPT;
 698                         break;
 699                 }
 700
 701                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 702                         err = -EINVAL;
 703                         break;
 704                 }
 705
 706                 mode = l2cap_get_mode(chan);
 707                 if (mode < 0) {
 708                         err = mode;
 709                         break;
 710                 }
 711
 712                 if (put_user(mode, (u8 __user *) optval))
 713                         err = -EFAULT;
 714                 break;
 715
 716         default:
 717                 err = -ENOPROTOOPT;
 718                 break;
 719         }
 720
 721         release_sock(sk);
 722         return err;
 723 }
 724
 725 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 726 {
 727         switch (chan->scid) {
 728         case L2CAP_CID_ATT:
 729                 if (mtu < L2CAP_LE_MIN_MTU)
 730                         return false;
 731                 break;
 732
 733         default:
 734                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 735                         return false;
 736         }
 737
 738         return true;
 739 }
 740
 741 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 742                                      sockptr_t optval, unsigned int optlen)
 743 {
 744         struct sock *sk = sock->sk;
 745         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 746         struct l2cap_options opts;
 747         int len, err = 0;
 748         u32 opt;
 749
 750         BT_DBG("sk %p", sk);
 751
 752         lock_sock(sk);
 753
 754         switch (optname) {
 755         case L2CAP_OPTIONS:
 756                 if (bdaddr_type_is_le(chan->src_type)) {
 757                         err = -EINVAL;
 758                         break;
 759                 }
 760
 761                 if (sk->sk_state == BT_CONNECTED) {
 762                         err = -EINVAL;
 763                         break;
 764                 }
 765
 766                 opts.imtu     = chan->imtu;
 767                 opts.omtu     = chan->omtu;
 768                 opts.flush_to = chan->flush_to;
 769                 opts.mode     = chan->mode;
 770                 opts.fcs      = chan->fcs;
 771                 opts.max_tx   = chan->max_tx;
 772                 opts.txwin_size = chan->tx_win;
 773
 774                 len = min_t(unsigned int, sizeof(opts), optlen);
 775                 if (copy_from_sockptr(&opts, optval, len)) {
 776                         err = -EFAULT;
 777                         break;
 778                 }
 779
 780                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 781                         err = -EINVAL;
 782                         break;
 783                 }
 784
 785                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 786                         err = -EINVAL;
 787                         break;
 788                 }
 789
 790                 /* Only BR/EDR modes are supported here */
 791                 switch (opts.mode) {
 792                 case L2CAP_MODE_BASIC:
 793                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 794                         break;
 795                 case L2CAP_MODE_ERTM:
 796                 case L2CAP_MODE_STREAMING:
 797                         if (!disable_ertm)
 798                                 break;
 799                         fallthrough;
 800                 default:
 801                         err = -EINVAL;
 802                         break;
 803                 }
 804
 805                 if (err < 0)
 806                         break;
 807
 808                 chan->mode = opts.mode;
 809
 810                 BT_DBG("mode 0x%2.2x", chan->mode);
 811
 812                 chan->imtu = opts.imtu;
 813                 chan->omtu = opts.omtu;
 814                 chan->fcs  = opts.fcs;
 815                 chan->max_tx = opts.max_tx;
 816                 chan->tx_win = opts.txwin_size;
 817                 chan->flush_to = opts.flush_to;
 818                 break;
 819
 820         case L2CAP_LM:
 821                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 822                         err = -EFAULT;
 823                         break;
 824                 }
 825
 826                 if (opt & L2CAP_LM_FIPS) {
 827                         err = -EINVAL;
 828                         break;
 829                 }
 830
 831                 if (opt & L2CAP_LM_AUTH)
 832                         chan->sec_level = BT_SECURITY_LOW;
 833                 if (opt & L2CAP_LM_ENCRYPT)
 834                         chan->sec_level = BT_SECURITY_MEDIUM;
 835                 if (opt & L2CAP_LM_SECURE)
 836                         chan->sec_level = BT_SECURITY_HIGH;
 837
 838                 if (opt & L2CAP_LM_MASTER)
 839                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 840                 else
 841                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 842
 843                 if (opt & L2CAP_LM_RELIABLE)
 844                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 845                 else
 846                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 847                 break;
 848
 849         default:
 850                 err = -ENOPROTOOPT;
 851                 break;
 852         }
 853
 854         release_sock(sk);
 855         return err;
 856 }
 857
 858 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 859 {
 860         switch (mode) {
 861         case BT_MODE_BASIC:
 862                 if (bdaddr_type_is_le(chan->src_type))
 863                         return -EINVAL;
 864                 mode = L2CAP_MODE_BASIC;
 865                 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 866                 break;
 867         case BT_MODE_ERTM:
 868                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 869                         return -EINVAL;
 870                 mode = L2CAP_MODE_ERTM;
 871                 break;
 872         case BT_MODE_STREAMING:
 873                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 874                         return -EINVAL;
 875                 mode = L2CAP_MODE_STREAMING;
 876                 break;
 877         case BT_MODE_LE_FLOWCTL:
 878                 if (!bdaddr_type_is_le(chan->src_type))
 879                         return -EINVAL;
 880                 mode = L2CAP_MODE_LE_FLOWCTL;
 881                 break;
 882         case BT_MODE_EXT_FLOWCTL:
 883                 /* TODO: Add support for ECRED PDUs to BR/EDR */
 884                 if (!bdaddr_type_is_le(chan->src_type))
 885                         return -EINVAL;
 886                 mode = L2CAP_MODE_EXT_FLOWCTL;
 887                 break;
 888         default:
 889                 return -EINVAL;
 890         }
 891
 892         chan->mode = mode;
 893
 894         return 0;
 895 }
 896
 897 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 898                                  sockptr_t optval, unsigned int optlen)
 899 {
 900         struct sock *sk = sock->sk;
 901         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 902         struct bt_security sec;
 903         struct bt_power pwr;
 904         struct l2cap_conn *conn;
 905         int len, err = 0;
 906         u32 opt;
 907         u16 mtu;
 908         u8 mode;
 909
 910         BT_DBG("sk %p", sk);
 911
 912         if (level == SOL_L2CAP)
 913                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 914
 915         if (level != SOL_BLUETOOTH)
 916                 return -ENOPROTOOPT;
 917
 918         lock_sock(sk);
 919
 920         switch (optname) {
 921         case BT_SECURITY:
 922                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 923                     chan->chan_type != L2CAP_CHAN_FIXED &&
 924                     chan->chan_type != L2CAP_CHAN_RAW) {
 925                         err = -EINVAL;
 926                         break;
 927                 }
 928
 929                 sec.level = BT_SECURITY_LOW;
 930
 931                 len = min_t(unsigned int, sizeof(sec), optlen);
 932                 if (copy_from_sockptr(&sec, optval, len)) {
 933                         err = -EFAULT;
 934                         break;
 935                 }
 936
 937                 if (sec.level < BT_SECURITY_LOW ||
 938                     sec.level > BT_SECURITY_FIPS) {
 939                         err = -EINVAL;
 940                         break;
 941                 }
 942
 943                 chan->sec_level = sec.level;
 944
 945                 if (!chan->conn)
 946                         break;
 947
 948                 conn = chan->conn;
 949
 950                 /* change security for LE channels */
 951                 if (chan->scid == L2CAP_CID_ATT) {
 952                         if (smp_conn_security(conn->hcon, sec.level)) {
 953                                 err = -EINVAL;
 954                                 break;
 955                         }
 956
 957                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 958                         sk->sk_state = BT_CONFIG;
 959                         chan->state = BT_CONFIG;
 960
 961                 /* or for ACL link */
 962                 } else if ((sk->sk_state == BT_CONNECT2 &&
 963                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 964                            sk->sk_state == BT_CONNECTED) {
 965                         if (!l2cap_chan_check_security(chan, true))
 966                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 967                         else
 968                                 sk->sk_state_change(sk);
 969                 } else {
 970                         err = -EINVAL;
 971                 }
 972                 break;
 973
 974         case BT_DEFER_SETUP:
 975                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 976                         err = -EINVAL;
 977                         break;
 978                 }
 979
 980                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 981                         err = -EFAULT;
 982                         break;
 983                 }
 984
 985                 if (opt) {
 986                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 987                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 988                 } else {
 989                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 990                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 991                 }
 992                 break;
 993
 994         case BT_FLUSHABLE:
 995                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 996                         err = -EFAULT;
 997                         break;
 998                 }
 999
1000                 if (opt > BT_FLUSHABLE_ON) {
1001                         err = -EINVAL;
1002                         break;
1003                 }
1004
1005                 if (opt == BT_FLUSHABLE_OFF) {
1006                         conn = chan->conn;
1007                         /* proceed further only when we have l2cap_conn and
1008                            No Flush support in the LM */
1009                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
1010                                 err = -EINVAL;
1011                                 break;
1012                         }
1013                 }
1014
1015                 if (opt)
1016                         set_bit(FLAG_FLUSHABLE, &chan->flags);
1017                 else
1018                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
1019                 break;
1020
1021         case BT_POWER:
1022                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1023                     chan->chan_type != L2CAP_CHAN_RAW) {
1024                         err = -EINVAL;
1025                         break;
1026                 }
1027
1028                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1029
1030                 len = min_t(unsigned int, sizeof(pwr), optlen);
1031                 if (copy_from_sockptr(&pwr, optval, len)) {
1032                         err = -EFAULT;
1033                         break;
1034                 }
1035
1036                 if (pwr.force_active)
1037                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1038                 else
1039                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1040                 break;
1041
1042         case BT_CHANNEL_POLICY:
1043                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
1044                         err = -EFAULT;
1045                         break;
1046                 }
1047
1048                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
1049                         err = -EINVAL;
1050                         break;
1051                 }
1052
1053                 if (chan->mode != L2CAP_MODE_ERTM &&
1054                     chan->mode != L2CAP_MODE_STREAMING) {
1055                         err = -EOPNOTSUPP;
1056                         break;
1057                 }
1058
1059                 chan->chan_policy = (u8) opt;
1060
1061                 if (sk->sk_state == BT_CONNECTED &&
1062                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
1063                         l2cap_move_start(chan);
1064
1065                 break;
1066
1067         case BT_SNDMTU:
1068                 if (!bdaddr_type_is_le(chan->src_type)) {
1069                         err = -EINVAL;
1070                         break;
1071                 }
1072
1073                 /* Setting is not supported as it's the remote side that
1074                  * decides this.
1075                  */
1076                 err = -EPERM;
1077                 break;
1078
1079         case BT_RCVMTU:
1080                 if (!bdaddr_type_is_le(chan->src_type)) {
1081                         err = -EINVAL;
1082                         break;
1083                 }
1084
1085                 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1086                     sk->sk_state == BT_CONNECTED) {
1087                         err = -EISCONN;
1088                         break;
1089                 }
1090
1091                 if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
1092                         err = -EFAULT;
1093                         break;
1094                 }
1095
1096                 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1097                     sk->sk_state == BT_CONNECTED)
1098                         err = l2cap_chan_reconfigure(chan, mtu);
1099                 else
1100                         chan->imtu = mtu;
1101
1102                 break;
1103
1104         case BT_MODE:
1105                 if (!enable_ecred) {
1106                         err = -ENOPROTOOPT;
1107                         break;
1108                 }
1109
1110                 BT_DBG("sk->sk_state %u", sk->sk_state);
1111
1112                 if (sk->sk_state != BT_BOUND) {
1113                         err = -EINVAL;
1114                         break;
1115                 }
1116
1117                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1118                         err = -EINVAL;
1119                         break;
1120                 }
1121
1122                 if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
1123                         err = -EFAULT;
1124                         break;
1125                 }
1126
1127                 BT_DBG("mode %u", mode);
1128
1129                 err = l2cap_set_mode(chan, mode);
1130                 if (err)
1131                         break;
1132
1133                 BT_DBG("mode 0x%2.2x", chan->mode);
1134
1135                 break;
1136
1137         default:
1138                 err = -ENOPROTOOPT;
1139                 break;
1140         }
1141
1142         release_sock(sk);
1143         return err;
1144 }
1145
1146 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1147                               size_t len)
1148 {
1149         struct sock *sk = sock->sk;
1150         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1151         int err;
1152
1153         BT_DBG("sock %p, sk %p", sock, sk);
1154
1155         err = sock_error(sk);
1156         if (err)
1157                 return err;
1158
1159         if (msg->msg_flags & MSG_OOB)
1160                 return -EOPNOTSUPP;
1161
1162         if (sk->sk_state != BT_CONNECTED)
1163                 return -ENOTCONN;
1164
1165         lock_sock(sk);
1166         err = bt_sock_wait_ready(sk, msg->msg_flags);
1167         release_sock(sk);
1168         if (err)
1169                 return err;
1170
1171         l2cap_chan_lock(chan);
1172         err = l2cap_chan_send(chan, msg, len);
1173         l2cap_chan_unlock(chan);
1174
1175         return err;
1176 }
1177
1178 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1179                               size_t len, int flags)
1180 {
1181         struct sock *sk = sock->sk;
1182         struct l2cap_pinfo *pi = l2cap_pi(sk);
1183         int err;
1184
1185         lock_sock(sk);
1186
1187         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1188                                                     &bt_sk(sk)->flags)) {
1189                 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1190                         sk->sk_state = BT_CONNECTED;
1191                         pi->chan->state = BT_CONNECTED;
1192                         __l2cap_ecred_conn_rsp_defer(pi->chan);
1193                 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1194                         sk->sk_state = BT_CONNECTED;
1195                         pi->chan->state = BT_CONNECTED;
1196                         __l2cap_le_connect_rsp_defer(pi->chan);
1197                 } else {
1198                         sk->sk_state = BT_CONFIG;
1199                         pi->chan->state = BT_CONFIG;
1200                         __l2cap_connect_rsp_defer(pi->chan);
1201                 }
1202
1203                 err = 0;
1204                 goto done;
1205         }
1206
1207         release_sock(sk);
1208
1209         if (sock->type == SOCK_STREAM)
1210                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1211         else
1212                 err = bt_sock_recvmsg(sock, msg, len, flags);
1213
1214         if (pi->chan->mode != L2CAP_MODE_ERTM)
1215                 return err;
1216
1217         /* Attempt to put pending rx data in the socket buffer */
1218
1219         lock_sock(sk);
1220
1221         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1222                 goto done;
1223
1224         if (pi->rx_busy_skb) {
1225                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1226                         pi->rx_busy_skb = NULL;
1227                 else
1228                         goto done;
1229         }
1230
1231         /* Restore data flow when half of the receive buffer is
1232          * available.  This avoids resending large numbers of
1233          * frames.
1234          */
1235         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1236                 l2cap_chan_busy(pi->chan, 0);
1237
1238 done:
1239         release_sock(sk);
1240         return err;
1241 }
1242
1243 /* Kill socket (only if zapped and orphan)
1244  * Must be called on unlocked socket, with l2cap channel lock.
1245  */
1246 static void l2cap_sock_kill(struct sock *sk)
1247 {
1248         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1249                 return;
1250
1251         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1252
1253         /* Kill poor orphan */
1254
1255         l2cap_chan_put(l2cap_pi(sk)->chan);
1256         sock_set_flag(sk, SOCK_DEAD);
1257         sock_put(sk);
1258 }
1259
1260 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1261 {
1262         DECLARE_WAITQUEUE(wait, current);
1263         int err = 0;
1264         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1265         /* Timeout to prevent infinite loop */
1266         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1267
1268         add_wait_queue(sk_sleep(sk), &wait);
1269         set_current_state(TASK_INTERRUPTIBLE);
1270         do {
1271                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1272                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1273                        jiffies_to_msecs(timeout - jiffies));
1274
1275                 if (!timeo)
1276                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1277
1278                 if (signal_pending(current)) {
1279                         err = sock_intr_errno(timeo);
1280                         break;
1281                 }
1282
1283                 release_sock(sk);
1284                 timeo = schedule_timeout(timeo);
1285                 lock_sock(sk);
1286                 set_current_state(TASK_INTERRUPTIBLE);
1287
1288                 err = sock_error(sk);
1289                 if (err)
1290                         break;
1291
1292                 if (time_after(jiffies, timeout)) {
1293                         err = -ENOLINK;
1294                         break;
1295                 }
1296
1297         } while (chan->unacked_frames > 0 &&
1298                  chan->state == BT_CONNECTED);
1299
1300         set_current_state(TASK_RUNNING);
1301         remove_wait_queue(sk_sleep(sk), &wait);
1302         return err;
1303 }
1304
1305 static int l2cap_sock_shutdown(struct socket *sock, int how)
1306 {
1307         struct sock *sk = sock->sk;
1308         struct l2cap_chan *chan;
1309         struct l2cap_conn *conn;
1310         int err = 0;
1311
1312         BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1313
1314         /* 'how' parameter is mapped to sk_shutdown as follows:
1315          * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1316          * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1317          * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1318          */
1319         how++;
1320
1321         if (!sk)
1322                 return 0;
1323
1324         lock_sock(sk);
1325
1326         if ((sk->sk_shutdown & how) == how)
1327                 goto shutdown_already;
1328
1329         BT_DBG("Handling sock shutdown");
1330
1331         /* prevent sk structure from being freed whilst unlocked */
1332         sock_hold(sk);
1333
1334         chan = l2cap_pi(sk)->chan;
1335         /* prevent chan structure from being freed whilst unlocked */
1336         l2cap_chan_hold(chan);
1337
1338         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1339
1340         if (chan->mode == L2CAP_MODE_ERTM &&
1341             chan->unacked_frames > 0 &&
1342             chan->state == BT_CONNECTED) {
1343                 err = __l2cap_wait_ack(sk, chan);
1344
1345                 /* After waiting for ACKs, check whether shutdown
1346                  * has already been actioned to close the L2CAP
1347                  * link such as by l2cap_disconnection_req().
1348                  */
1349                 if ((sk->sk_shutdown & how) == how)
1350                         goto shutdown_matched;
1351         }
1352
1353         /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1354          * is already set
1355          */
1356         if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1357                 sk->sk_shutdown |= RCV_SHUTDOWN;
1358                 if ((sk->sk_shutdown & how) == how)
1359                         goto shutdown_matched;
1360         }
1361
1362         sk->sk_shutdown |= SEND_SHUTDOWN;
1363         release_sock(sk);
1364
1365         l2cap_chan_lock(chan);
1366         conn = chan->conn;
1367         if (conn)
1368                 /* prevent conn structure from being freed */
1369                 l2cap_conn_get(conn);
1370         l2cap_chan_unlock(chan);
1371
1372         if (conn)
1373                 /* mutex lock must be taken before l2cap_chan_lock() */
1374                 mutex_lock(&conn->chan_lock);
1375
1376         l2cap_chan_lock(chan);
1377         l2cap_chan_close(chan, 0);
1378         l2cap_chan_unlock(chan);
1379
1380         if (conn) {
1381                 mutex_unlock(&conn->chan_lock);
1382                 l2cap_conn_put(conn);
1383         }
1384
1385         lock_sock(sk);
1386
1387         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1388             !(current->flags & PF_EXITING))
1389                 err = bt_sock_wait_state(sk, BT_CLOSED,
1390                                          sk->sk_lingertime);
1391
1392 shutdown_matched:
1393         l2cap_chan_put(chan);
1394         sock_put(sk);
1395
1396 shutdown_already:
1397         if (!err && sk->sk_err)
1398                 err = -sk->sk_err;
1399
1400         release_sock(sk);
1401
1402         BT_DBG("Sock shutdown complete err: %d", err);
1403
1404         return err;
1405 }
1406
1407 static int l2cap_sock_release(struct socket *sock)
1408 {
1409         struct sock *sk = sock->sk;
1410         int err;
1411         struct l2cap_chan *chan;
1412
1413         BT_DBG("sock %p, sk %p", sock, sk);
1414
1415         if (!sk)
1416                 return 0;
1417
1418         l2cap_sock_cleanup_listen(sk);
1419         bt_sock_unlink(&l2cap_sk_list, sk);
1420
1421         err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1422         chan = l2cap_pi(sk)->chan;
1423
1424         l2cap_chan_hold(chan);
1425         l2cap_chan_lock(chan);
1426
1427         sock_orphan(sk);
1428         l2cap_sock_kill(sk);
1429
1430         l2cap_chan_unlock(chan);
1431         l2cap_chan_put(chan);
1432
1433         return err;
1434 }
1435
1436 static void l2cap_sock_cleanup_listen(struct sock *parent)
1437 {
1438         struct sock *sk;
1439
1440         BT_DBG("parent %p state %s", parent,
1441                state_to_string(parent->sk_state));
1442
1443         /* Close not yet accepted channels */
1444         while ((sk = bt_accept_dequeue(parent, NULL))) {
1445                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1446
1447                 BT_DBG("child chan %p state %s", chan,
1448                        state_to_string(chan->state));
1449
1450                 l2cap_chan_hold(chan);
1451                 l2cap_chan_lock(chan);
1452
1453                 __clear_chan_timer(chan);
1454                 l2cap_chan_close(chan, ECONNRESET);
1455                 l2cap_sock_kill(sk);
1456
1457                 l2cap_chan_unlock(chan);
1458                 l2cap_chan_put(chan);
1459         }
1460 }
1461
1462 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1463 {
1464         struct sock *sk, *parent = chan->data;
1465
1466         lock_sock(parent);
1467
1468         /* Check for backlog size */
1469         if (sk_acceptq_is_full(parent)) {
1470                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1471                 release_sock(parent);
1472                 return NULL;
1473         }
1474
1475         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1476                               GFP_ATOMIC, 0);
1477         if (!sk) {
1478                 release_sock(parent);
1479                 return NULL;
1480         }
1481
1482         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1483
1484         l2cap_sock_init(sk, parent);
1485
1486         bt_accept_enqueue(parent, sk, false);
1487
1488         release_sock(parent);
1489
1490         return l2cap_pi(sk)->chan;
1491 }
1492
1493 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1494 {
1495         struct sock *sk = chan->data;
1496         int err;
1497
1498         lock_sock(sk);
1499
1500         if (l2cap_pi(sk)->rx_busy_skb) {
1501                 err = -ENOMEM;
1502                 goto done;
1503         }
1504
1505         if (chan->mode != L2CAP_MODE_ERTM &&
1506             chan->mode != L2CAP_MODE_STREAMING) {
1507                 /* Even if no filter is attached, we could potentially
1508                  * get errors from security modules, etc.
1509                  */
1510                 err = sk_filter(sk, skb);
1511                 if (err)
1512                         goto done;
1513         }
1514
1515         err = __sock_queue_rcv_skb(sk, skb);
1516
1517         /* For ERTM, handle one skb that doesn't fit into the recv
1518          * buffer.  This is important to do because the data frames
1519          * have already been acked, so the skb cannot be discarded.
1520          *
1521          * Notify the l2cap core that the buffer is full, so the
1522          * LOCAL_BUSY state is entered and no more frames are
1523          * acked and reassembled until there is buffer space
1524          * available.
1525          */
1526         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1527                 l2cap_pi(sk)->rx_busy_skb = skb;
1528                 l2cap_chan_busy(chan, 1);
1529                 err = 0;
1530         }
1531
1532 done:
1533         release_sock(sk);
1534
1535         return err;
1536 }
1537
1538 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1539 {
1540         struct sock *sk = chan->data;
1541
1542         if (!sk)
1543                 return;
1544
1545         l2cap_sock_kill(sk);
1546 }
1547
1548 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1549 {
1550         struct sock *sk = chan->data;
1551         struct sock *parent;
1552
1553         if (!sk)
1554                 return;
1555
1556         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1557
1558         /* This callback can be called both for server (BT_LISTEN)
1559          * sockets as well as "normal" ones. To avoid lockdep warnings
1560          * with child socket locking (through l2cap_sock_cleanup_listen)
1561          * we need separation into separate nesting levels. The simplest
1562          * way to accomplish this is to inherit the nesting level used
1563          * for the channel.
1564          */
1565         lock_sock_nested(sk, atomic_read(&chan->nesting));
1566
1567         parent = bt_sk(sk)->parent;
1568
1569         switch (chan->state) {
1570         case BT_OPEN:
1571         case BT_BOUND:
1572         case BT_CLOSED:
1573                 break;
1574         case BT_LISTEN:
1575                 l2cap_sock_cleanup_listen(sk);
1576                 sk->sk_state = BT_CLOSED;
1577                 chan->state = BT_CLOSED;
1578
1579                 break;
1580         default:
1581                 sk->sk_state = BT_CLOSED;
1582                 chan->state = BT_CLOSED;
1583
1584                 sk->sk_err = err;
1585
1586                 if (parent) {
1587                         bt_accept_unlink(sk);
1588                         parent->sk_data_ready(parent);
1589                 } else {
1590                         sk->sk_state_change(sk);
1591                 }
1592
1593                 break;
1594         }
1595         release_sock(sk);
1596
1597         /* Only zap after cleanup to avoid use after free race */
1598         sock_set_flag(sk, SOCK_ZAPPED);
1599
1600 }
1601
1602 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1603                                        int err)
1604 {
1605         struct sock *sk = chan->data;
1606
1607         sk->sk_state = state;
1608
1609         if (err)
1610                 sk->sk_err = err;
1611 }
1612
1613 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1614                                                unsigned long hdr_len,
1615                                                unsigned long len, int nb)
1616 {
1617         struct sock *sk = chan->data;
1618         struct sk_buff *skb;
1619         int err;
1620
1621         l2cap_chan_unlock(chan);
1622         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1623         l2cap_chan_lock(chan);
1624
1625         if (!skb)
1626                 return ERR_PTR(err);
1627
1628         /* Channel lock is released before requesting new skb and then
1629          * reacquired thus we need to recheck channel state.
1630          */
1631         if (chan->state != BT_CONNECTED) {
1632                 kfree_skb(skb);
1633                 return ERR_PTR(-ENOTCONN);
1634         }
1635
1636         skb->priority = sk->sk_priority;
1637
1638         bt_cb(skb)->l2cap.chan = chan;
1639
1640         return skb;
1641 }
1642
1643 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1644 {
1645         struct sock *sk = chan->data;
1646         struct sock *parent;
1647
1648         lock_sock(sk);
1649
1650         parent = bt_sk(sk)->parent;
1651
1652         BT_DBG("sk %p, parent %p", sk, parent);
1653
1654         sk->sk_state = BT_CONNECTED;
1655         sk->sk_state_change(sk);
1656
1657         if (parent)
1658                 parent->sk_data_ready(parent);
1659
1660         release_sock(sk);
1661 }
1662
1663 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1664 {
1665         struct sock *parent, *sk = chan->data;
1666
1667         lock_sock(sk);
1668
1669         parent = bt_sk(sk)->parent;
1670         if (parent)
1671                 parent->sk_data_ready(parent);
1672
1673         release_sock(sk);
1674 }
1675
1676 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1677 {
1678         struct sock *sk = chan->data;
1679
1680         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1681                 sk->sk_state = BT_CONNECTED;
1682                 chan->state = BT_CONNECTED;
1683         }
1684
1685         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1686         sk->sk_state_change(sk);
1687 }
1688
1689 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1690 {
1691         struct sock *sk = chan->data;
1692
1693         lock_sock(sk);
1694         sk->sk_shutdown = SHUTDOWN_MASK;
1695         release_sock(sk);
1696 }
1697
1698 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1699 {
1700         struct sock *sk = chan->data;
1701
1702         return sk->sk_sndtimeo;
1703 }
1704
1705 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1706 {
1707         struct sock *sk = chan->data;
1708
1709         return sk->sk_peer_pid;
1710 }
1711
1712 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1713 {
1714         struct sock *sk = chan->data;
1715
1716         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1717         sk->sk_state_change(sk);
1718 }
1719
1720 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1721 {
1722         struct sock *sk = chan->data;
1723
1724         switch (chan->mode) {
1725         case L2CAP_MODE_ERTM:
1726         case L2CAP_MODE_STREAMING:
1727                 return sk_filter(sk, skb);
1728         }
1729
1730         return 0;
1731 }
1732
1733 static const struct l2cap_ops l2cap_chan_ops = {
1734         .name                   = "L2CAP Socket Interface",
1735         .new_connection         = l2cap_sock_new_connection_cb,
1736         .recv                   = l2cap_sock_recv_cb,
1737         .close                  = l2cap_sock_close_cb,
1738         .teardown               = l2cap_sock_teardown_cb,
1739         .state_change           = l2cap_sock_state_change_cb,
1740         .ready                  = l2cap_sock_ready_cb,
1741         .defer                  = l2cap_sock_defer_cb,
1742         .resume                 = l2cap_sock_resume_cb,
1743         .suspend                = l2cap_sock_suspend_cb,
1744         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1745         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1746         .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
1747         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1748         .filter                 = l2cap_sock_filter,
1749 };
1750
1751 static void l2cap_sock_destruct(struct sock *sk)
1752 {
1753         BT_DBG("sk %p", sk);
1754
1755         if (l2cap_pi(sk)->chan) {
1756                 l2cap_pi(sk)->chan->data = NULL;
1757                 l2cap_chan_put(l2cap_pi(sk)->chan);
1758         }
1759
1760         if (l2cap_pi(sk)->rx_busy_skb) {
1761                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1762                 l2cap_pi(sk)->rx_busy_skb = NULL;
1763         }
1764
1765         skb_queue_purge(&sk->sk_receive_queue);
1766         skb_queue_purge(&sk->sk_write_queue);
1767 }
1768
1769 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1770                                int *msg_namelen)
1771 {
1772         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1773
1774         memset(la, 0, sizeof(struct sockaddr_l2));
1775         la->l2_family = AF_BLUETOOTH;
1776         la->l2_psm = bt_cb(skb)->l2cap.psm;
1777         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1778
1779         *msg_namelen = sizeof(struct sockaddr_l2);
1780 }
1781
1782 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1783 {
1784         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1785
1786         BT_DBG("sk %p", sk);
1787
1788         if (parent) {
1789                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1790
1791                 sk->sk_type = parent->sk_type;
1792                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1793
1794                 chan->chan_type = pchan->chan_type;
1795                 chan->imtu = pchan->imtu;
1796                 chan->omtu = pchan->omtu;
1797                 chan->conf_state = pchan->conf_state;
1798                 chan->mode = pchan->mode;
1799                 chan->fcs  = pchan->fcs;
1800                 chan->max_tx = pchan->max_tx;
1801                 chan->tx_win = pchan->tx_win;
1802                 chan->tx_win_max = pchan->tx_win_max;
1803                 chan->sec_level = pchan->sec_level;
1804                 chan->flags = pchan->flags;
1805                 chan->tx_credits = pchan->tx_credits;
1806                 chan->rx_credits = pchan->rx_credits;
1807
1808                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1809                         chan->scid = pchan->scid;
1810                         chan->dcid = pchan->scid;
1811                 }
1812
1813                 security_sk_clone(parent, sk);
1814         } else {
1815                 switch (sk->sk_type) {
1816                 case SOCK_RAW:
1817                         chan->chan_type = L2CAP_CHAN_RAW;
1818                         break;
1819                 case SOCK_DGRAM:
1820                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1821                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1822                         break;
1823                 case SOCK_SEQPACKET:
1824                 case SOCK_STREAM:
1825                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1826                         break;
1827                 }
1828
1829                 chan->imtu = L2CAP_DEFAULT_MTU;
1830                 chan->omtu = 0;
1831                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1832                         chan->mode = L2CAP_MODE_ERTM;
1833                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1834                 } else {
1835                         chan->mode = L2CAP_MODE_BASIC;
1836                 }
1837
1838                 l2cap_chan_set_defaults(chan);
1839         }
1840
1841         /* Default config options */
1842         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1843
1844         chan->data = sk;
1845         chan->ops = &l2cap_chan_ops;
1846 }
1847
1848 static struct proto l2cap_proto = {
1849         .name           = "L2CAP",
1850         .owner          = THIS_MODULE,
1851         .obj_size       = sizeof(struct l2cap_pinfo)
1852 };
1853
1854 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1855                                      int proto, gfp_t prio, int kern)
1856 {
1857         struct sock *sk;
1858         struct l2cap_chan *chan;
1859
1860         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1861         if (!sk)
1862                 return NULL;
1863
1864         sock_init_data(sock, sk);
1865         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1866
1867         sk->sk_destruct = l2cap_sock_destruct;
1868         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1869
1870         sock_reset_flag(sk, SOCK_ZAPPED);
1871
1872         sk->sk_protocol = proto;
1873         sk->sk_state = BT_OPEN;
1874
1875         chan = l2cap_chan_create();
1876         if (!chan) {
1877                 sk_free(sk);
1878                 return NULL;
1879         }
1880
1881         l2cap_chan_hold(chan);
1882
1883         l2cap_pi(sk)->chan = chan;
1884
1885         return sk;
1886 }
1887
1888 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1889                              int kern)
1890 {
1891         struct sock *sk;
1892
1893         BT_DBG("sock %p", sock);
1894
1895         sock->state = SS_UNCONNECTED;
1896
1897         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1898             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1899                 return -ESOCKTNOSUPPORT;
1900
1901         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1902                 return -EPERM;
1903
1904         sock->ops = &l2cap_sock_ops;
1905
1906         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1907         if (!sk)
1908                 return -ENOMEM;
1909
1910         l2cap_sock_init(sk, NULL);
1911         bt_sock_link(&l2cap_sk_list, sk);
1912         return 0;
1913 }
1914
1915 static const struct proto_ops l2cap_sock_ops = {
1916         .family         = PF_BLUETOOTH,
1917         .owner          = THIS_MODULE,
1918         .release        = l2cap_sock_release,
1919         .bind           = l2cap_sock_bind,
1920         .connect        = l2cap_sock_connect,
1921         .listen         = l2cap_sock_listen,
1922         .accept         = l2cap_sock_accept,
1923         .getname        = l2cap_sock_getname,
1924         .sendmsg        = l2cap_sock_sendmsg,
1925         .recvmsg        = l2cap_sock_recvmsg,
1926         .poll           = bt_sock_poll,
1927         .ioctl          = bt_sock_ioctl,
1928         .gettstamp      = sock_gettstamp,
1929         .mmap           = sock_no_mmap,
1930         .socketpair     = sock_no_socketpair,
1931         .shutdown       = l2cap_sock_shutdown,
1932         .setsockopt     = l2cap_sock_setsockopt,
1933         .getsockopt     = l2cap_sock_getsockopt
1934 };
1935
1936 static const struct net_proto_family l2cap_sock_family_ops = {
1937         .family = PF_BLUETOOTH,
1938         .owner  = THIS_MODULE,
1939         .create = l2cap_sock_create,
1940 };
1941
1942 int __init l2cap_init_sockets(void)
1943 {
1944         int err;
1945
1946         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1947
1948         err = proto_register(&l2cap_proto, 0);
1949         if (err < 0)
1950                 return err;
1951
1952         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1953         if (err < 0) {
1954                 BT_ERR("L2CAP socket registration failed");
1955                 goto error;
1956         }
1957
1958         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1959                              NULL);
1960         if (err < 0) {
1961                 BT_ERR("Failed to create L2CAP proc file");
1962                 bt_sock_unregister(BTPROTO_L2CAP);
1963                 goto error;
1964         }
1965
1966         BT_INFO("L2CAP socket layer initialized");
1967
1968         return 0;
1969
1970 error:
1971         proto_unregister(&l2cap_proto);
1972         return err;
1973 }
1974
1975 void l2cap_cleanup_sockets(void)
1976 {
1977         bt_procfs_cleanup(&init_net, "l2cap");
1978         bt_sock_unregister(BTPROTO_L2CAP);
1979         proto_unregister(&l2cap_proto);
1980 }