net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/sched/signal.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/l2cap.h>
  37
  38 #include "smp.h"
  39
  40 static struct bt_sock_list l2cap_sk_list = {
  41         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  42 };
  43
  44 static const struct proto_ops l2cap_sock_ops;
  45 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  46 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  47                                      int proto, gfp_t prio, int kern);
  48
  49 bool l2cap_is_socket(struct socket *sock)
  50 {
  51         return sock && sock->ops == &l2cap_sock_ops;
  52 }
  53 EXPORT_SYMBOL(l2cap_is_socket);
  54
  55 static int l2cap_validate_bredr_psm(u16 psm)
  56 {
  57         /* PSM must be odd and lsb of upper byte must be 0 */
  58         if ((psm & 0x0101) != 0x0001)
  59                 return -EINVAL;
  60
  61         /* Restrict usage of well-known PSMs */
  62         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  63                 return -EACCES;
  64
  65         return 0;
  66 }
  67
  68 static int l2cap_validate_le_psm(u16 psm)
  69 {
  70         /* Valid LE_PSM ranges are defined only until 0x00ff */
  71         if (psm > L2CAP_PSM_LE_DYN_END)
  72                 return -EINVAL;
  73
  74         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  75         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  76                 return -EACCES;
  77
  78         return 0;
  79 }
  80
  81 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  82 {
  83         struct sock *sk = sock->sk;
  84         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  85         struct sockaddr_l2 la;
  86         int len, err = 0;
  87
  88         BT_DBG("sk %p", sk);
  89
  90         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  91             addr->sa_family != AF_BLUETOOTH)
  92                 return -EINVAL;
  93
  94         memset(&la, 0, sizeof(la));
  95         len = min_t(unsigned int, sizeof(la), alen);
  96         memcpy(&la, addr, len);
  97
  98         if (la.l2_cid && la.l2_psm)
  99                 return -EINVAL;
 100
 101         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 102                 return -EINVAL;
 103
 104         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 105                 /* We only allow ATT user space socket */
 106                 if (la.l2_cid &&
 107                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 108                         return -EINVAL;
 109         }
 110
 111         lock_sock(sk);
 112
 113         if (sk->sk_state != BT_OPEN) {
 114                 err = -EBADFD;
 115                 goto done;
 116         }
 117
 118         if (la.l2_psm) {
 119                 __u16 psm = __le16_to_cpu(la.l2_psm);
 120
 121                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 122                         err = l2cap_validate_bredr_psm(psm);
 123                 else
 124                         err = l2cap_validate_le_psm(psm);
 125
 126                 if (err)
 127                         goto done;
 128         }
 129
 130         bacpy(&chan->src, &la.l2_bdaddr);
 131         chan->src_type = la.l2_bdaddr_type;
 132
 133         if (la.l2_cid)
 134                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 135         else
 136                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 137
 138         if (err < 0)
 139                 goto done;
 140
 141         switch (chan->chan_type) {
 142         case L2CAP_CHAN_CONN_LESS:
 143                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 144                         chan->sec_level = BT_SECURITY_SDP;
 145                 break;
 146         case L2CAP_CHAN_CONN_ORIENTED:
 147                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 148                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 149                         chan->sec_level = BT_SECURITY_SDP;
 150                 break;
 151         case L2CAP_CHAN_RAW:
 152                 chan->sec_level = BT_SECURITY_SDP;
 153                 break;
 154         case L2CAP_CHAN_FIXED:
 155                 /* Fixed channels default to the L2CAP core not holding a
 156                  * hci_conn reference for them. For fixed channels mapping to
 157                  * L2CAP sockets we do want to hold a reference so set the
 158                  * appropriate flag to request it.
 159                  */
 160                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 161                 break;
 162         }
 163
 164         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 165                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 166
 167         chan->state = BT_BOUND;
 168         sk->sk_state = BT_BOUND;
 169
 170 done:
 171         release_sock(sk);
 172         return err;
 173 }
 174
 175 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 176                               int alen, int flags)
 177 {
 178         struct sock *sk = sock->sk;
 179         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 180         struct sockaddr_l2 la;
 181         int len, err = 0;
 182         bool zapped;
 183
 184         BT_DBG("sk %p", sk);
 185
 186         lock_sock(sk);
 187         zapped = sock_flag(sk, SOCK_ZAPPED);
 188         release_sock(sk);
 189
 190         if (zapped)
 191                 return -EINVAL;
 192
 193         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 194             addr->sa_family != AF_BLUETOOTH)
 195                 return -EINVAL;
 196
 197         memset(&la, 0, sizeof(la));
 198         len = min_t(unsigned int, sizeof(la), alen);
 199         memcpy(&la, addr, len);
 200
 201         if (la.l2_cid && la.l2_psm)
 202                 return -EINVAL;
 203
 204         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 205                 return -EINVAL;
 206
 207         /* Check that the socket wasn't bound to something that
 208          * conflicts with the address given to connect(). If chan->src
 209          * is BDADDR_ANY it means bind() was never used, in which case
 210          * chan->src_type and la.l2_bdaddr_type do not need to match.
 211          */
 212         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 213             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 214                 /* Old user space versions will try to incorrectly bind
 215                  * the ATT socket using BDADDR_BREDR. We need to accept
 216                  * this and fix up the source address type only when
 217                  * both the source CID and destination CID indicate
 218                  * ATT. Anything else is an invalid combination.
 219                  */
 220                 if (chan->scid != L2CAP_CID_ATT ||
 221                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 222                         return -EINVAL;
 223
 224                 /* We don't have the hdev available here to make a
 225                  * better decision on random vs public, but since all
 226                  * user space versions that exhibit this issue anyway do
 227                  * not support random local addresses assuming public
 228                  * here is good enough.
 229                  */
 230                 chan->src_type = BDADDR_LE_PUBLIC;
 231         }
 232
 233         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 234                 return -EINVAL;
 235
 236         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 237                 /* We only allow ATT user space socket */
 238                 if (la.l2_cid &&
 239                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 240                         return -EINVAL;
 241         }
 242
 243         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 244                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 245
 246         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 247                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 248         if (err)
 249                 return err;
 250
 251         lock_sock(sk);
 252
 253         err = bt_sock_wait_state(sk, BT_CONNECTED,
 254                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 255
 256         release_sock(sk);
 257
 258         return err;
 259 }
 260
 261 static int l2cap_sock_listen(struct socket *sock, int backlog)
 262 {
 263         struct sock *sk = sock->sk;
 264         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 265         int err = 0;
 266
 267         BT_DBG("sk %p backlog %d", sk, backlog);
 268
 269         lock_sock(sk);
 270
 271         if (sk->sk_state != BT_BOUND) {
 272                 err = -EBADFD;
 273                 goto done;
 274         }
 275
 276         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 277                 err = -EINVAL;
 278                 goto done;
 279         }
 280
 281         switch (chan->mode) {
 282         case L2CAP_MODE_BASIC:
 283         case L2CAP_MODE_LE_FLOWCTL:
 284                 break;
 285         case L2CAP_MODE_ERTM:
 286         case L2CAP_MODE_STREAMING:
 287                 if (!disable_ertm)
 288                         break;
 289                 /* fall through */
 290         default:
 291                 err = -EOPNOTSUPP;
 292                 goto done;
 293         }
 294
 295         sk->sk_max_ack_backlog = backlog;
 296         sk->sk_ack_backlog = 0;
 297
 298         /* Listening channels need to use nested locking in order not to
 299          * cause lockdep warnings when the created child channels end up
 300          * being locked in the same thread as the parent channel.
 301          */
 302         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 303
 304         chan->state = BT_LISTEN;
 305         sk->sk_state = BT_LISTEN;
 306
 307 done:
 308         release_sock(sk);
 309         return err;
 310 }
 311
 312 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 313                              int flags, bool kern)
 314 {
 315         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 316         struct sock *sk = sock->sk, *nsk;
 317         long timeo;
 318         int err = 0;
 319
 320         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 321
 322         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 323
 324         BT_DBG("sk %p timeo %ld", sk, timeo);
 325
 326         /* Wait for an incoming connection. (wake-one). */
 327         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 328         while (1) {
 329                 if (sk->sk_state != BT_LISTEN) {
 330                         err = -EBADFD;
 331                         break;
 332                 }
 333
 334                 nsk = bt_accept_dequeue(sk, newsock);
 335                 if (nsk)
 336                         break;
 337
 338                 if (!timeo) {
 339                         err = -EAGAIN;
 340                         break;
 341                 }
 342
 343                 if (signal_pending(current)) {
 344                         err = sock_intr_errno(timeo);
 345                         break;
 346                 }
 347
 348                 release_sock(sk);
 349
 350                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 351
 352                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 353         }
 354         remove_wait_queue(sk_sleep(sk), &wait);
 355
 356         if (err)
 357                 goto done;
 358
 359         newsock->state = SS_CONNECTED;
 360
 361         BT_DBG("new socket %p", nsk);
 362
 363 done:
 364         release_sock(sk);
 365         return err;
 366 }
 367
 368 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 369                               int peer)
 370 {
 371         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 372         struct sock *sk = sock->sk;
 373         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 374
 375         BT_DBG("sock %p, sk %p", sock, sk);
 376
 377         if (peer && sk->sk_state != BT_CONNECTED &&
 378             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 379             sk->sk_state != BT_CONFIG)
 380                 return -ENOTCONN;
 381
 382         memset(la, 0, sizeof(struct sockaddr_l2));
 383         addr->sa_family = AF_BLUETOOTH;
 384
 385         la->l2_psm = chan->psm;
 386
 387         if (peer) {
 388                 bacpy(&la->l2_bdaddr, &chan->dst);
 389                 la->l2_cid = cpu_to_le16(chan->dcid);
 390                 la->l2_bdaddr_type = chan->dst_type;
 391         } else {
 392                 bacpy(&la->l2_bdaddr, &chan->src);
 393                 la->l2_cid = cpu_to_le16(chan->scid);
 394                 la->l2_bdaddr_type = chan->src_type;
 395         }
 396
 397         return sizeof(struct sockaddr_l2);
 398 }
 399
 400 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 401                                      char __user *optval, int __user *optlen)
 402 {
 403         struct sock *sk = sock->sk;
 404         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 405         struct l2cap_options opts;
 406         struct l2cap_conninfo cinfo;
 407         int len, err = 0;
 408         u32 opt;
 409
 410         BT_DBG("sk %p", sk);
 411
 412         if (get_user(len, optlen))
 413                 return -EFAULT;
 414
 415         lock_sock(sk);
 416
 417         switch (optname) {
 418         case L2CAP_OPTIONS:
 419                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 420                  * legacy ATT code depends on getsockopt for
 421                  * L2CAP_OPTIONS we need to let this pass.
 422                  */
 423                 if (bdaddr_type_is_le(chan->src_type) &&
 424                     chan->scid != L2CAP_CID_ATT) {
 425                         err = -EINVAL;
 426                         break;
 427                 }
 428
 429                 memset(&opts, 0, sizeof(opts));
 430                 opts.imtu     = chan->imtu;
 431                 opts.omtu     = chan->omtu;
 432                 opts.flush_to = chan->flush_to;
 433                 opts.mode     = chan->mode;
 434                 opts.fcs      = chan->fcs;
 435                 opts.max_tx   = chan->max_tx;
 436                 opts.txwin_size = chan->tx_win;
 437
 438                 len = min_t(unsigned int, len, sizeof(opts));
 439                 if (copy_to_user(optval, (char *) &opts, len))
 440                         err = -EFAULT;
 441
 442                 break;
 443
 444         case L2CAP_LM:
 445                 switch (chan->sec_level) {
 446                 case BT_SECURITY_LOW:
 447                         opt = L2CAP_LM_AUTH;
 448                         break;
 449                 case BT_SECURITY_MEDIUM:
 450                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 451                         break;
 452                 case BT_SECURITY_HIGH:
 453                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 454                               L2CAP_LM_SECURE;
 455                         break;
 456                 case BT_SECURITY_FIPS:
 457                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 458                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 459                         break;
 460                 default:
 461                         opt = 0;
 462                         break;
 463                 }
 464
 465                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 466                         opt |= L2CAP_LM_MASTER;
 467
 468                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 469                         opt |= L2CAP_LM_RELIABLE;
 470
 471                 if (put_user(opt, (u32 __user *) optval))
 472                         err = -EFAULT;
 473
 474                 break;
 475
 476         case L2CAP_CONNINFO:
 477                 if (sk->sk_state != BT_CONNECTED &&
 478                     !(sk->sk_state == BT_CONNECT2 &&
 479                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 480                         err = -ENOTCONN;
 481                         break;
 482                 }
 483
 484                 memset(&cinfo, 0, sizeof(cinfo));
 485                 cinfo.hci_handle = chan->conn->hcon->handle;
 486                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 487
 488                 len = min_t(unsigned int, len, sizeof(cinfo));
 489                 if (copy_to_user(optval, (char *) &cinfo, len))
 490                         err = -EFAULT;
 491
 492                 break;
 493
 494         default:
 495                 err = -ENOPROTOOPT;
 496                 break;
 497         }
 498
 499         release_sock(sk);
 500         return err;
 501 }
 502
 503 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 504                                  char __user *optval, int __user *optlen)
 505 {
 506         struct sock *sk = sock->sk;
 507         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 508         struct bt_security sec;
 509         struct bt_power pwr;
 510         int len, err = 0;
 511
 512         BT_DBG("sk %p", sk);
 513
 514         if (level == SOL_L2CAP)
 515                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 516
 517         if (level != SOL_BLUETOOTH)
 518                 return -ENOPROTOOPT;
 519
 520         if (get_user(len, optlen))
 521                 return -EFAULT;
 522
 523         lock_sock(sk);
 524
 525         switch (optname) {
 526         case BT_SECURITY:
 527                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 528                     chan->chan_type != L2CAP_CHAN_FIXED &&
 529                     chan->chan_type != L2CAP_CHAN_RAW) {
 530                         err = -EINVAL;
 531                         break;
 532                 }
 533
 534                 memset(&sec, 0, sizeof(sec));
 535                 if (chan->conn) {
 536                         sec.level = chan->conn->hcon->sec_level;
 537
 538                         if (sk->sk_state == BT_CONNECTED)
 539                                 sec.key_size = chan->conn->hcon->enc_key_size;
 540                 } else {
 541                         sec.level = chan->sec_level;
 542                 }
 543
 544                 len = min_t(unsigned int, len, sizeof(sec));
 545                 if (copy_to_user(optval, (char *) &sec, len))
 546                         err = -EFAULT;
 547
 548                 break;
 549
 550         case BT_DEFER_SETUP:
 551                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 552                         err = -EINVAL;
 553                         break;
 554                 }
 555
 556                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 557                              (u32 __user *) optval))
 558                         err = -EFAULT;
 559
 560                 break;
 561
 562         case BT_FLUSHABLE:
 563                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 564                              (u32 __user *) optval))
 565                         err = -EFAULT;
 566
 567                 break;
 568
 569         case BT_POWER:
 570                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 571                     && sk->sk_type != SOCK_RAW) {
 572                         err = -EINVAL;
 573                         break;
 574                 }
 575
 576                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 577
 578                 len = min_t(unsigned int, len, sizeof(pwr));
 579                 if (copy_to_user(optval, (char *) &pwr, len))
 580                         err = -EFAULT;
 581
 582                 break;
 583
 584         case BT_CHANNEL_POLICY:
 585                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 586                         err = -EFAULT;
 587                 break;
 588
 589         case BT_SNDMTU:
 590                 if (!bdaddr_type_is_le(chan->src_type)) {
 591                         err = -EINVAL;
 592                         break;
 593                 }
 594
 595                 if (sk->sk_state != BT_CONNECTED) {
 596                         err = -ENOTCONN;
 597                         break;
 598                 }
 599
 600                 if (put_user(chan->omtu, (u16 __user *) optval))
 601                         err = -EFAULT;
 602                 break;
 603
 604         case BT_RCVMTU:
 605                 if (!bdaddr_type_is_le(chan->src_type)) {
 606                         err = -EINVAL;
 607                         break;
 608                 }
 609
 610                 if (put_user(chan->imtu, (u16 __user *) optval))
 611                         err = -EFAULT;
 612                 break;
 613
 614         default:
 615                 err = -ENOPROTOOPT;
 616                 break;
 617         }
 618
 619         release_sock(sk);
 620         return err;
 621 }
 622
 623 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 624 {
 625         switch (chan->scid) {
 626         case L2CAP_CID_ATT:
 627                 if (mtu < L2CAP_LE_MIN_MTU)
 628                         return false;
 629                 break;
 630
 631         default:
 632                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 633                         return false;
 634         }
 635
 636         return true;
 637 }
 638
 639 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 640                                      char __user *optval, unsigned int optlen)
 641 {
 642         struct sock *sk = sock->sk;
 643         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 644         struct l2cap_options opts;
 645         int len, err = 0;
 646         u32 opt;
 647
 648         BT_DBG("sk %p", sk);
 649
 650         lock_sock(sk);
 651
 652         switch (optname) {
 653         case L2CAP_OPTIONS:
 654                 if (bdaddr_type_is_le(chan->src_type)) {
 655                         err = -EINVAL;
 656                         break;
 657                 }
 658
 659                 if (sk->sk_state == BT_CONNECTED) {
 660                         err = -EINVAL;
 661                         break;
 662                 }
 663
 664                 opts.imtu     = chan->imtu;
 665                 opts.omtu     = chan->omtu;
 666                 opts.flush_to = chan->flush_to;
 667                 opts.mode     = chan->mode;
 668                 opts.fcs      = chan->fcs;
 669                 opts.max_tx   = chan->max_tx;
 670                 opts.txwin_size = chan->tx_win;
 671
 672                 len = min_t(unsigned int, sizeof(opts), optlen);
 673                 if (copy_from_user((char *) &opts, optval, len)) {
 674                         err = -EFAULT;
 675                         break;
 676                 }
 677
 678                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 679                         err = -EINVAL;
 680                         break;
 681                 }
 682
 683                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 684                         err = -EINVAL;
 685                         break;
 686                 }
 687
 688                 chan->mode = opts.mode;
 689                 switch (chan->mode) {
 690                 case L2CAP_MODE_LE_FLOWCTL:
 691                         break;
 692                 case L2CAP_MODE_BASIC:
 693                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 694                         break;
 695                 case L2CAP_MODE_ERTM:
 696                 case L2CAP_MODE_STREAMING:
 697                         if (!disable_ertm)
 698                                 break;
 699                         /* fall through */
 700                 default:
 701                         err = -EINVAL;
 702                         break;
 703                 }
 704
 705                 chan->imtu = opts.imtu;
 706                 chan->omtu = opts.omtu;
 707                 chan->fcs  = opts.fcs;
 708                 chan->max_tx = opts.max_tx;
 709                 chan->tx_win = opts.txwin_size;
 710                 chan->flush_to = opts.flush_to;
 711                 break;
 712
 713         case L2CAP_LM:
 714                 if (get_user(opt, (u32 __user *) optval)) {
 715                         err = -EFAULT;
 716                         break;
 717                 }
 718
 719                 if (opt & L2CAP_LM_FIPS) {
 720                         err = -EINVAL;
 721                         break;
 722                 }
 723
 724                 if (opt & L2CAP_LM_AUTH)
 725                         chan->sec_level = BT_SECURITY_LOW;
 726                 if (opt & L2CAP_LM_ENCRYPT)
 727                         chan->sec_level = BT_SECURITY_MEDIUM;
 728                 if (opt & L2CAP_LM_SECURE)
 729                         chan->sec_level = BT_SECURITY_HIGH;
 730
 731                 if (opt & L2CAP_LM_MASTER)
 732                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 733                 else
 734                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 735
 736                 if (opt & L2CAP_LM_RELIABLE)
 737                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 738                 else
 739                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 740                 break;
 741
 742         default:
 743                 err = -ENOPROTOOPT;
 744                 break;
 745         }
 746
 747         release_sock(sk);
 748         return err;
 749 }
 750
 751 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 752                                  char __user *optval, unsigned int optlen)
 753 {
 754         struct sock *sk = sock->sk;
 755         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 756         struct bt_security sec;
 757         struct bt_power pwr;
 758         struct l2cap_conn *conn;
 759         int len, err = 0;
 760         u32 opt;
 761
 762         BT_DBG("sk %p", sk);
 763
 764         if (level == SOL_L2CAP)
 765                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 766
 767         if (level != SOL_BLUETOOTH)
 768                 return -ENOPROTOOPT;
 769
 770         lock_sock(sk);
 771
 772         switch (optname) {
 773         case BT_SECURITY:
 774                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 775                     chan->chan_type != L2CAP_CHAN_FIXED &&
 776                     chan->chan_type != L2CAP_CHAN_RAW) {
 777                         err = -EINVAL;
 778                         break;
 779                 }
 780
 781                 sec.level = BT_SECURITY_LOW;
 782
 783                 len = min_t(unsigned int, sizeof(sec), optlen);
 784                 if (copy_from_user((char *) &sec, optval, len)) {
 785                         err = -EFAULT;
 786                         break;
 787                 }
 788
 789                 if (sec.level < BT_SECURITY_LOW ||
 790                     sec.level > BT_SECURITY_FIPS) {
 791                         err = -EINVAL;
 792                         break;
 793                 }
 794
 795                 chan->sec_level = sec.level;
 796
 797                 if (!chan->conn)
 798                         break;
 799
 800                 conn = chan->conn;
 801
 802                 /*change security for LE channels */
 803                 if (chan->scid == L2CAP_CID_ATT) {
 804                         if (smp_conn_security(conn->hcon, sec.level))
 805                                 break;
 806                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 807                         sk->sk_state = BT_CONFIG;
 808                         chan->state = BT_CONFIG;
 809
 810                 /* or for ACL link */
 811                 } else if ((sk->sk_state == BT_CONNECT2 &&
 812                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 813                            sk->sk_state == BT_CONNECTED) {
 814                         if (!l2cap_chan_check_security(chan, true))
 815                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 816                         else
 817                                 sk->sk_state_change(sk);
 818                 } else {
 819                         err = -EINVAL;
 820                 }
 821                 break;
 822
 823         case BT_DEFER_SETUP:
 824                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 825                         err = -EINVAL;
 826                         break;
 827                 }
 828
 829                 if (get_user(opt, (u32 __user *) optval)) {
 830                         err = -EFAULT;
 831                         break;
 832                 }
 833
 834                 if (opt) {
 835                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 836                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 837                 } else {
 838                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 839                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 840                 }
 841                 break;
 842
 843         case BT_FLUSHABLE:
 844                 if (get_user(opt, (u32 __user *) optval)) {
 845                         err = -EFAULT;
 846                         break;
 847                 }
 848
 849                 if (opt > BT_FLUSHABLE_ON) {
 850                         err = -EINVAL;
 851                         break;
 852                 }
 853
 854                 if (opt == BT_FLUSHABLE_OFF) {
 855                         conn = chan->conn;
 856                         /* proceed further only when we have l2cap_conn and
 857                            No Flush support in the LM */
 858                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 859                                 err = -EINVAL;
 860                                 break;
 861                         }
 862                 }
 863
 864                 if (opt)
 865                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 866                 else
 867                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 868                 break;
 869
 870         case BT_POWER:
 871                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 872                     chan->chan_type != L2CAP_CHAN_RAW) {
 873                         err = -EINVAL;
 874                         break;
 875                 }
 876
 877                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 878
 879                 len = min_t(unsigned int, sizeof(pwr), optlen);
 880                 if (copy_from_user((char *) &pwr, optval, len)) {
 881                         err = -EFAULT;
 882                         break;
 883                 }
 884
 885                 if (pwr.force_active)
 886                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 887                 else
 888                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 889                 break;
 890
 891         case BT_CHANNEL_POLICY:
 892                 if (get_user(opt, (u32 __user *) optval)) {
 893                         err = -EFAULT;
 894                         break;
 895                 }
 896
 897                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 898                         err = -EINVAL;
 899                         break;
 900                 }
 901
 902                 if (chan->mode != L2CAP_MODE_ERTM &&
 903                     chan->mode != L2CAP_MODE_STREAMING) {
 904                         err = -EOPNOTSUPP;
 905                         break;
 906                 }
 907
 908                 chan->chan_policy = (u8) opt;
 909
 910                 if (sk->sk_state == BT_CONNECTED &&
 911                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 912                         l2cap_move_start(chan);
 913
 914                 break;
 915
 916         case BT_SNDMTU:
 917                 if (!bdaddr_type_is_le(chan->src_type)) {
 918                         err = -EINVAL;
 919                         break;
 920                 }
 921
 922                 /* Setting is not supported as it's the remote side that
 923                  * decides this.
 924                  */
 925                 err = -EPERM;
 926                 break;
 927
 928         case BT_RCVMTU:
 929                 if (!bdaddr_type_is_le(chan->src_type)) {
 930                         err = -EINVAL;
 931                         break;
 932                 }
 933
 934                 if (sk->sk_state == BT_CONNECTED) {
 935                         err = -EISCONN;
 936                         break;
 937                 }
 938
 939                 if (get_user(opt, (u16 __user *) optval)) {
 940                         err = -EFAULT;
 941                         break;
 942                 }
 943
 944                 chan->imtu = opt;
 945                 break;
 946
 947         default:
 948                 err = -ENOPROTOOPT;
 949                 break;
 950         }
 951
 952         release_sock(sk);
 953         return err;
 954 }
 955
 956 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 957                               size_t len)
 958 {
 959         struct sock *sk = sock->sk;
 960         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 961         int err;
 962
 963         BT_DBG("sock %p, sk %p", sock, sk);
 964
 965         err = sock_error(sk);
 966         if (err)
 967                 return err;
 968
 969         if (msg->msg_flags & MSG_OOB)
 970                 return -EOPNOTSUPP;
 971
 972         if (sk->sk_state != BT_CONNECTED)
 973                 return -ENOTCONN;
 974
 975         lock_sock(sk);
 976         err = bt_sock_wait_ready(sk, msg->msg_flags);
 977         release_sock(sk);
 978         if (err)
 979                 return err;
 980
 981         l2cap_chan_lock(chan);
 982         err = l2cap_chan_send(chan, msg, len);
 983         l2cap_chan_unlock(chan);
 984
 985         return err;
 986 }
 987
 988 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 989                               size_t len, int flags)
 990 {
 991         struct sock *sk = sock->sk;
 992         struct l2cap_pinfo *pi = l2cap_pi(sk);
 993         int err;
 994
 995         lock_sock(sk);
 996
 997         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 998                                                     &bt_sk(sk)->flags)) {
 999                 if (bdaddr_type_is_le(pi->chan->src_type)) {
1000                         sk->sk_state = BT_CONNECTED;
1001                         pi->chan->state = BT_CONNECTED;
1002                         __l2cap_le_connect_rsp_defer(pi->chan);
1003                 } else {
1004                         sk->sk_state = BT_CONFIG;
1005                         pi->chan->state = BT_CONFIG;
1006                         __l2cap_connect_rsp_defer(pi->chan);
1007                 }
1008
1009                 err = 0;
1010                 goto done;
1011         }
1012
1013         release_sock(sk);
1014
1015         if (sock->type == SOCK_STREAM)
1016                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1017         else
1018                 err = bt_sock_recvmsg(sock, msg, len, flags);
1019
1020         if (pi->chan->mode != L2CAP_MODE_ERTM)
1021                 return err;
1022
1023         /* Attempt to put pending rx data in the socket buffer */
1024
1025         lock_sock(sk);
1026
1027         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1028                 goto done;
1029
1030         if (pi->rx_busy_skb) {
1031                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1032                         pi->rx_busy_skb = NULL;
1033                 else
1034                         goto done;
1035         }
1036
1037         /* Restore data flow when half of the receive buffer is
1038          * available.  This avoids resending large numbers of
1039          * frames.
1040          */
1041         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1042                 l2cap_chan_busy(pi->chan, 0);
1043
1044 done:
1045         release_sock(sk);
1046         return err;
1047 }
1048
1049 /* Kill socket (only if zapped and orphan)
1050  * Must be called on unlocked socket, with l2cap channel lock.
1051  */
1052 static void l2cap_sock_kill(struct sock *sk)
1053 {
1054         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1055                 return;
1056
1057         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1058
1059         /* Kill poor orphan */
1060
1061         l2cap_chan_put(l2cap_pi(sk)->chan);
1062         sock_set_flag(sk, SOCK_DEAD);
1063         sock_put(sk);
1064 }
1065
1066 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1067 {
1068         DECLARE_WAITQUEUE(wait, current);
1069         int err = 0;
1070         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1071         /* Timeout to prevent infinite loop */
1072         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1073
1074         add_wait_queue(sk_sleep(sk), &wait);
1075         set_current_state(TASK_INTERRUPTIBLE);
1076         do {
1077                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1078                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1079                        jiffies_to_msecs(timeout - jiffies));
1080
1081                 if (!timeo)
1082                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1083
1084                 if (signal_pending(current)) {
1085                         err = sock_intr_errno(timeo);
1086                         break;
1087                 }
1088
1089                 release_sock(sk);
1090                 timeo = schedule_timeout(timeo);
1091                 lock_sock(sk);
1092                 set_current_state(TASK_INTERRUPTIBLE);
1093
1094                 err = sock_error(sk);
1095                 if (err)
1096                         break;
1097
1098                 if (time_after(jiffies, timeout)) {
1099                         err = -ENOLINK;
1100                         break;
1101                 }
1102
1103         } while (chan->unacked_frames > 0 &&
1104                  chan->state == BT_CONNECTED);
1105
1106         set_current_state(TASK_RUNNING);
1107         remove_wait_queue(sk_sleep(sk), &wait);
1108         return err;
1109 }
1110
1111 static int l2cap_sock_shutdown(struct socket *sock, int how)
1112 {
1113         struct sock *sk = sock->sk;
1114         struct l2cap_chan *chan;
1115         struct l2cap_conn *conn;
1116         int err = 0;
1117
1118         BT_DBG("sock %p, sk %p", sock, sk);
1119
1120         if (!sk)
1121                 return 0;
1122
1123         lock_sock(sk);
1124
1125         if (sk->sk_shutdown)
1126                 goto shutdown_already;
1127
1128         BT_DBG("Handling sock shutdown");
1129
1130         /* prevent sk structure from being freed whilst unlocked */
1131         sock_hold(sk);
1132
1133         chan = l2cap_pi(sk)->chan;
1134         /* prevent chan structure from being freed whilst unlocked */
1135         l2cap_chan_hold(chan);
1136
1137         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1138
1139         if (chan->mode == L2CAP_MODE_ERTM &&
1140             chan->unacked_frames > 0 &&
1141             chan->state == BT_CONNECTED) {
1142                 err = __l2cap_wait_ack(sk, chan);
1143
1144                 /* After waiting for ACKs, check whether shutdown
1145                  * has already been actioned to close the L2CAP
1146                  * link such as by l2cap_disconnection_req().
1147                  */
1148                 if (sk->sk_shutdown)
1149                         goto has_shutdown;
1150         }
1151
1152         sk->sk_shutdown = SHUTDOWN_MASK;
1153         release_sock(sk);
1154
1155         l2cap_chan_lock(chan);
1156         conn = chan->conn;
1157         if (conn)
1158                 /* prevent conn structure from being freed */
1159                 l2cap_conn_get(conn);
1160         l2cap_chan_unlock(chan);
1161
1162         if (conn)
1163                 /* mutex lock must be taken before l2cap_chan_lock() */
1164                 mutex_lock(&conn->chan_lock);
1165
1166         l2cap_chan_lock(chan);
1167         l2cap_chan_close(chan, 0);
1168         l2cap_chan_unlock(chan);
1169
1170         if (conn) {
1171                 mutex_unlock(&conn->chan_lock);
1172                 l2cap_conn_put(conn);
1173         }
1174
1175         lock_sock(sk);
1176
1177         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1178             !(current->flags & PF_EXITING))
1179                 err = bt_sock_wait_state(sk, BT_CLOSED,
1180                                          sk->sk_lingertime);
1181
1182 has_shutdown:
1183         l2cap_chan_put(chan);
1184         sock_put(sk);
1185
1186 shutdown_already:
1187         if (!err && sk->sk_err)
1188                 err = -sk->sk_err;
1189
1190         release_sock(sk);
1191
1192         BT_DBG("Sock shutdown complete err: %d", err);
1193
1194         return err;
1195 }
1196
1197 static int l2cap_sock_release(struct socket *sock)
1198 {
1199         struct sock *sk = sock->sk;
1200         int err;
1201         struct l2cap_chan *chan;
1202
1203         BT_DBG("sock %p, sk %p", sock, sk);
1204
1205         if (!sk)
1206                 return 0;
1207
1208         bt_sock_unlink(&l2cap_sk_list, sk);
1209
1210         err = l2cap_sock_shutdown(sock, 2);
1211         chan = l2cap_pi(sk)->chan;
1212
1213         l2cap_chan_hold(chan);
1214         l2cap_chan_lock(chan);
1215
1216         sock_orphan(sk);
1217         l2cap_sock_kill(sk);
1218
1219         l2cap_chan_unlock(chan);
1220         l2cap_chan_put(chan);
1221
1222         return err;
1223 }
1224
1225 static void l2cap_sock_cleanup_listen(struct sock *parent)
1226 {
1227         struct sock *sk;
1228
1229         BT_DBG("parent %p state %s", parent,
1230                state_to_string(parent->sk_state));
1231
1232         /* Close not yet accepted channels */
1233         while ((sk = bt_accept_dequeue(parent, NULL))) {
1234                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1235
1236                 BT_DBG("child chan %p state %s", chan,
1237                        state_to_string(chan->state));
1238
1239                 l2cap_chan_hold(chan);
1240                 l2cap_chan_lock(chan);
1241
1242                 __clear_chan_timer(chan);
1243                 l2cap_chan_close(chan, ECONNRESET);
1244                 l2cap_sock_kill(sk);
1245
1246                 l2cap_chan_unlock(chan);
1247                 l2cap_chan_put(chan);
1248         }
1249 }
1250
1251 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1252 {
1253         struct sock *sk, *parent = chan->data;
1254
1255         lock_sock(parent);
1256
1257         /* Check for backlog size */
1258         if (sk_acceptq_is_full(parent)) {
1259                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1260                 release_sock(parent);
1261                 return NULL;
1262         }
1263
1264         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1265                               GFP_ATOMIC, 0);
1266         if (!sk) {
1267                 release_sock(parent);
1268                 return NULL;
1269         }
1270
1271         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1272
1273         l2cap_sock_init(sk, parent);
1274
1275         bt_accept_enqueue(parent, sk, false);
1276
1277         release_sock(parent);
1278
1279         return l2cap_pi(sk)->chan;
1280 }
1281
1282 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1283 {
1284         struct sock *sk = chan->data;
1285         int err;
1286
1287         lock_sock(sk);
1288
1289         if (l2cap_pi(sk)->rx_busy_skb) {
1290                 err = -ENOMEM;
1291                 goto done;
1292         }
1293
1294         if (chan->mode != L2CAP_MODE_ERTM &&
1295             chan->mode != L2CAP_MODE_STREAMING) {
1296                 /* Even if no filter is attached, we could potentially
1297                  * get errors from security modules, etc.
1298                  */
1299                 err = sk_filter(sk, skb);
1300                 if (err)
1301                         goto done;
1302         }
1303
1304         err = __sock_queue_rcv_skb(sk, skb);
1305
1306         /* For ERTM, handle one skb that doesn't fit into the recv
1307          * buffer.  This is important to do because the data frames
1308          * have already been acked, so the skb cannot be discarded.
1309          *
1310          * Notify the l2cap core that the buffer is full, so the
1311          * LOCAL_BUSY state is entered and no more frames are
1312          * acked and reassembled until there is buffer space
1313          * available.
1314          */
1315         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1316                 l2cap_pi(sk)->rx_busy_skb = skb;
1317                 l2cap_chan_busy(chan, 1);
1318                 err = 0;
1319         }
1320
1321 done:
1322         release_sock(sk);
1323
1324         return err;
1325 }
1326
1327 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1328 {
1329         struct sock *sk = chan->data;
1330
1331         if (!sk)
1332                 return;
1333
1334         l2cap_sock_kill(sk);
1335 }
1336
1337 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1338 {
1339         struct sock *sk = chan->data;
1340         struct sock *parent;
1341
1342         if (!sk)
1343                 return;
1344
1345         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1346
1347         /* This callback can be called both for server (BT_LISTEN)
1348          * sockets as well as "normal" ones. To avoid lockdep warnings
1349          * with child socket locking (through l2cap_sock_cleanup_listen)
1350          * we need separation into separate nesting levels. The simplest
1351          * way to accomplish this is to inherit the nesting level used
1352          * for the channel.
1353          */
1354         lock_sock_nested(sk, atomic_read(&chan->nesting));
1355
1356         parent = bt_sk(sk)->parent;
1357
1358         switch (chan->state) {
1359         case BT_OPEN:
1360         case BT_BOUND:
1361         case BT_CLOSED:
1362                 break;
1363         case BT_LISTEN:
1364                 l2cap_sock_cleanup_listen(sk);
1365                 sk->sk_state = BT_CLOSED;
1366                 chan->state = BT_CLOSED;
1367
1368                 break;
1369         default:
1370                 sk->sk_state = BT_CLOSED;
1371                 chan->state = BT_CLOSED;
1372
1373                 sk->sk_err = err;
1374
1375                 if (parent) {
1376                         bt_accept_unlink(sk);
1377                         parent->sk_data_ready(parent);
1378                 } else {
1379                         sk->sk_state_change(sk);
1380                 }
1381
1382                 break;
1383         }
1384         release_sock(sk);
1385
1386         /* Only zap after cleanup to avoid use after free race */
1387         sock_set_flag(sk, SOCK_ZAPPED);
1388
1389 }
1390
1391 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1392                                        int err)
1393 {
1394         struct sock *sk = chan->data;
1395
1396         sk->sk_state = state;
1397
1398         if (err)
1399                 sk->sk_err = err;
1400 }
1401
1402 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1403                                                unsigned long hdr_len,
1404                                                unsigned long len, int nb)
1405 {
1406         struct sock *sk = chan->data;
1407         struct sk_buff *skb;
1408         int err;
1409
1410         l2cap_chan_unlock(chan);
1411         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1412         l2cap_chan_lock(chan);
1413
1414         if (!skb)
1415                 return ERR_PTR(err);
1416
1417         skb->priority = sk->sk_priority;
1418
1419         bt_cb(skb)->l2cap.chan = chan;
1420
1421         return skb;
1422 }
1423
1424 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1425 {
1426         struct sock *sk = chan->data;
1427         struct sock *parent;
1428
1429         lock_sock(sk);
1430
1431         parent = bt_sk(sk)->parent;
1432
1433         BT_DBG("sk %p, parent %p", sk, parent);
1434
1435         sk->sk_state = BT_CONNECTED;
1436         sk->sk_state_change(sk);
1437
1438         if (parent)
1439                 parent->sk_data_ready(parent);
1440
1441         release_sock(sk);
1442 }
1443
1444 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1445 {
1446         struct sock *parent, *sk = chan->data;
1447
1448         lock_sock(sk);
1449
1450         parent = bt_sk(sk)->parent;
1451         if (parent)
1452                 parent->sk_data_ready(parent);
1453
1454         release_sock(sk);
1455 }
1456
1457 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1458 {
1459         struct sock *sk = chan->data;
1460
1461         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1462                 sk->sk_state = BT_CONNECTED;
1463                 chan->state = BT_CONNECTED;
1464         }
1465
1466         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1467         sk->sk_state_change(sk);
1468 }
1469
1470 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1471 {
1472         struct sock *sk = chan->data;
1473
1474         lock_sock(sk);
1475         sk->sk_shutdown = SHUTDOWN_MASK;
1476         release_sock(sk);
1477 }
1478
1479 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1480 {
1481         struct sock *sk = chan->data;
1482
1483         return sk->sk_sndtimeo;
1484 }
1485
1486 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1487 {
1488         struct sock *sk = chan->data;
1489
1490         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1491         sk->sk_state_change(sk);
1492 }
1493
1494 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1495 {
1496         struct sock *sk = chan->data;
1497
1498         switch (chan->mode) {
1499         case L2CAP_MODE_ERTM:
1500         case L2CAP_MODE_STREAMING:
1501                 return sk_filter(sk, skb);
1502         }
1503
1504         return 0;
1505 }
1506
1507 static const struct l2cap_ops l2cap_chan_ops = {
1508         .name                   = "L2CAP Socket Interface",
1509         .new_connection         = l2cap_sock_new_connection_cb,
1510         .recv                   = l2cap_sock_recv_cb,
1511         .close                  = l2cap_sock_close_cb,
1512         .teardown               = l2cap_sock_teardown_cb,
1513         .state_change           = l2cap_sock_state_change_cb,
1514         .ready                  = l2cap_sock_ready_cb,
1515         .defer                  = l2cap_sock_defer_cb,
1516         .resume                 = l2cap_sock_resume_cb,
1517         .suspend                = l2cap_sock_suspend_cb,
1518         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1519         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1520         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1521         .filter                 = l2cap_sock_filter,
1522 };
1523
1524 static void l2cap_sock_destruct(struct sock *sk)
1525 {
1526         BT_DBG("sk %p", sk);
1527
1528         if (l2cap_pi(sk)->chan) {
1529                 l2cap_pi(sk)->chan->data = NULL;
1530                 l2cap_chan_put(l2cap_pi(sk)->chan);
1531         }
1532
1533         if (l2cap_pi(sk)->rx_busy_skb) {
1534                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1535                 l2cap_pi(sk)->rx_busy_skb = NULL;
1536         }
1537
1538         skb_queue_purge(&sk->sk_receive_queue);
1539         skb_queue_purge(&sk->sk_write_queue);
1540 }
1541
1542 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1543                                int *msg_namelen)
1544 {
1545         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1546
1547         memset(la, 0, sizeof(struct sockaddr_l2));
1548         la->l2_family = AF_BLUETOOTH;
1549         la->l2_psm = bt_cb(skb)->l2cap.psm;
1550         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1551
1552         *msg_namelen = sizeof(struct sockaddr_l2);
1553 }
1554
1555 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1556 {
1557         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1558
1559         BT_DBG("sk %p", sk);
1560
1561         if (parent) {
1562                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1563
1564                 sk->sk_type = parent->sk_type;
1565                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1566
1567                 chan->chan_type = pchan->chan_type;
1568                 chan->imtu = pchan->imtu;
1569                 chan->omtu = pchan->omtu;
1570                 chan->conf_state = pchan->conf_state;
1571                 chan->mode = pchan->mode;
1572                 chan->fcs  = pchan->fcs;
1573                 chan->max_tx = pchan->max_tx;
1574                 chan->tx_win = pchan->tx_win;
1575                 chan->tx_win_max = pchan->tx_win_max;
1576                 chan->sec_level = pchan->sec_level;
1577                 chan->flags = pchan->flags;
1578                 chan->tx_credits = pchan->tx_credits;
1579                 chan->rx_credits = pchan->rx_credits;
1580
1581                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1582                         chan->scid = pchan->scid;
1583                         chan->dcid = pchan->scid;
1584                 }
1585
1586                 security_sk_clone(parent, sk);
1587         } else {
1588                 switch (sk->sk_type) {
1589                 case SOCK_RAW:
1590                         chan->chan_type = L2CAP_CHAN_RAW;
1591                         break;
1592                 case SOCK_DGRAM:
1593                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1594                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1595                         break;
1596                 case SOCK_SEQPACKET:
1597                 case SOCK_STREAM:
1598                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1599                         break;
1600                 }
1601
1602                 chan->imtu = L2CAP_DEFAULT_MTU;
1603                 chan->omtu = 0;
1604                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1605                         chan->mode = L2CAP_MODE_ERTM;
1606                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1607                 } else {
1608                         chan->mode = L2CAP_MODE_BASIC;
1609                 }
1610
1611                 l2cap_chan_set_defaults(chan);
1612         }
1613
1614         /* Default config options */
1615         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1616
1617         chan->data = sk;
1618         chan->ops = &l2cap_chan_ops;
1619 }
1620
1621 static struct proto l2cap_proto = {
1622         .name           = "L2CAP",
1623         .owner          = THIS_MODULE,
1624         .obj_size       = sizeof(struct l2cap_pinfo)
1625 };
1626
1627 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1628                                      int proto, gfp_t prio, int kern)
1629 {
1630         struct sock *sk;
1631         struct l2cap_chan *chan;
1632
1633         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1634         if (!sk)
1635                 return NULL;
1636
1637         sock_init_data(sock, sk);
1638         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1639
1640         sk->sk_destruct = l2cap_sock_destruct;
1641         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1642
1643         sock_reset_flag(sk, SOCK_ZAPPED);
1644
1645         sk->sk_protocol = proto;
1646         sk->sk_state = BT_OPEN;
1647
1648         chan = l2cap_chan_create();
1649         if (!chan) {
1650                 sk_free(sk);
1651                 return NULL;
1652         }
1653
1654         l2cap_chan_hold(chan);
1655
1656         l2cap_pi(sk)->chan = chan;
1657
1658         return sk;
1659 }
1660
1661 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1662                              int kern)
1663 {
1664         struct sock *sk;
1665
1666         BT_DBG("sock %p", sock);
1667
1668         sock->state = SS_UNCONNECTED;
1669
1670         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1671             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1672                 return -ESOCKTNOSUPPORT;
1673
1674         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1675                 return -EPERM;
1676
1677         sock->ops = &l2cap_sock_ops;
1678
1679         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1680         if (!sk)
1681                 return -ENOMEM;
1682
1683         l2cap_sock_init(sk, NULL);
1684         bt_sock_link(&l2cap_sk_list, sk);
1685         return 0;
1686 }
1687
1688 static const struct proto_ops l2cap_sock_ops = {
1689         .family         = PF_BLUETOOTH,
1690         .owner          = THIS_MODULE,
1691         .release        = l2cap_sock_release,
1692         .bind           = l2cap_sock_bind,
1693         .connect        = l2cap_sock_connect,
1694         .listen         = l2cap_sock_listen,
1695         .accept         = l2cap_sock_accept,
1696         .getname        = l2cap_sock_getname,
1697         .sendmsg        = l2cap_sock_sendmsg,
1698         .recvmsg        = l2cap_sock_recvmsg,
1699         .poll           = bt_sock_poll,
1700         .ioctl          = bt_sock_ioctl,
1701         .mmap           = sock_no_mmap,
1702         .socketpair     = sock_no_socketpair,
1703         .shutdown       = l2cap_sock_shutdown,
1704         .setsockopt     = l2cap_sock_setsockopt,
1705         .getsockopt     = l2cap_sock_getsockopt
1706 };
1707
1708 static const struct net_proto_family l2cap_sock_family_ops = {
1709         .family = PF_BLUETOOTH,
1710         .owner  = THIS_MODULE,
1711         .create = l2cap_sock_create,
1712 };
1713
1714 int __init l2cap_init_sockets(void)
1715 {
1716         int err;
1717
1718         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1719
1720         err = proto_register(&l2cap_proto, 0);
1721         if (err < 0)
1722                 return err;
1723
1724         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1725         if (err < 0) {
1726                 BT_ERR("L2CAP socket registration failed");
1727                 goto error;
1728         }
1729
1730         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1731                              NULL);
1732         if (err < 0) {
1733                 BT_ERR("Failed to create L2CAP proc file");
1734                 bt_sock_unregister(BTPROTO_L2CAP);
1735                 goto error;
1736         }
1737
1738         BT_INFO("L2CAP socket layer initialized");
1739
1740         return 0;
1741
1742 error:
1743         proto_unregister(&l2cap_proto);
1744         return err;
1745 }
1746
1747 void l2cap_cleanup_sockets(void)
1748 {
1749         bt_procfs_cleanup(&init_net, "l2cap");
1750         bt_sock_unregister(BTPROTO_L2CAP);
1751         proto_unregister(&l2cap_proto);
1752 }