net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/filter.h>
  33 #include <linux/sched/signal.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38
  39 #include "smp.h"
  40
  41 static struct bt_sock_list l2cap_sk_list = {
  42         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43 };
  44
  45 static const struct proto_ops l2cap_sock_ops;
  46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48                                      int proto, gfp_t prio, int kern);
  49 static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51 bool l2cap_is_socket(struct socket *sock)
  52 {
  53         return sock && sock->ops == &l2cap_sock_ops;
  54 }
  55 EXPORT_SYMBOL(l2cap_is_socket);
  56
  57 static int l2cap_validate_bredr_psm(u16 psm)
  58 {
  59         /* PSM must be odd and lsb of upper byte must be 0 */
  60         if ((psm & 0x0101) != 0x0001)
  61                 return -EINVAL;
  62
  63         /* Restrict usage of well-known PSMs */
  64         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65                 return -EACCES;
  66
  67         return 0;
  68 }
  69
  70 static int l2cap_validate_le_psm(u16 psm)
  71 {
  72         /* Valid LE_PSM ranges are defined only until 0x00ff */
  73         if (psm > L2CAP_PSM_LE_DYN_END)
  74                 return -EINVAL;
  75
  76         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78                 return -EACCES;
  79
  80         return 0;
  81 }
  82
  83 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  84 {
  85         struct sock *sk = sock->sk;
  86         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87         struct sockaddr_l2 la;
  88         int len, err = 0;
  89
  90         BT_DBG("sk %p", sk);
  91
  92         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93             addr->sa_family != AF_BLUETOOTH)
  94                 return -EINVAL;
  95
  96         memset(&la, 0, sizeof(la));
  97         len = min_t(unsigned int, sizeof(la), alen);
  98         memcpy(&la, addr, len);
  99
 100         if (la.l2_cid && la.l2_psm)
 101                 return -EINVAL;
 102
 103         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104                 return -EINVAL;
 105
 106         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107                 /* We only allow ATT user space socket */
 108                 if (la.l2_cid &&
 109                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110                         return -EINVAL;
 111         }
 112
 113         lock_sock(sk);
 114
 115         if (sk->sk_state != BT_OPEN) {
 116                 err = -EBADFD;
 117                 goto done;
 118         }
 119
 120         if (la.l2_psm) {
 121                 __u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 124                         err = l2cap_validate_bredr_psm(psm);
 125                 else
 126                         err = l2cap_validate_le_psm(psm);
 127
 128                 if (err)
 129                         goto done;
 130         }
 131
 132         bacpy(&chan->src, &la.l2_bdaddr);
 133         chan->src_type = la.l2_bdaddr_type;
 134
 135         if (la.l2_cid)
 136                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137         else
 138                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140         if (err < 0)
 141                 goto done;
 142
 143         switch (chan->chan_type) {
 144         case L2CAP_CHAN_CONN_LESS:
 145                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146                         chan->sec_level = BT_SECURITY_SDP;
 147                 break;
 148         case L2CAP_CHAN_CONN_ORIENTED:
 149                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151                         chan->sec_level = BT_SECURITY_SDP;
 152                 break;
 153         case L2CAP_CHAN_RAW:
 154                 chan->sec_level = BT_SECURITY_SDP;
 155                 break;
 156         case L2CAP_CHAN_FIXED:
 157                 /* Fixed channels default to the L2CAP core not holding a
 158                  * hci_conn reference for them. For fixed channels mapping to
 159                  * L2CAP sockets we do want to hold a reference so set the
 160                  * appropriate flag to request it.
 161                  */
 162                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163                 break;
 164         }
 165
 166         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168          */
 169         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173         chan->state = BT_BOUND;
 174         sk->sk_state = BT_BOUND;
 175
 176 done:
 177         release_sock(sk);
 178         return err;
 179 }
 180
 181 static void l2cap_sock_init_pid(struct sock *sk)
 182 {
 183         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 184
 185         /* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to
 186          * group the channels being requested.
 187          */
 188         if (chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 189                 return;
 190
 191         spin_lock(&sk->sk_peer_lock);
 192         sk->sk_peer_pid = get_pid(task_tgid(current));
 193         spin_unlock(&sk->sk_peer_lock);
 194 }
 195
 196 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 197                               int alen, int flags)
 198 {
 199         struct sock *sk = sock->sk;
 200         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 201         struct sockaddr_l2 la;
 202         int len, err = 0;
 203         bool zapped;
 204
 205         BT_DBG("sk %p", sk);
 206
 207         lock_sock(sk);
 208         zapped = sock_flag(sk, SOCK_ZAPPED);
 209         release_sock(sk);
 210
 211         if (zapped)
 212                 return -EINVAL;
 213
 214         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 215             addr->sa_family != AF_BLUETOOTH)
 216                 return -EINVAL;
 217
 218         memset(&la, 0, sizeof(la));
 219         len = min_t(unsigned int, sizeof(la), alen);
 220         memcpy(&la, addr, len);
 221
 222         if (la.l2_cid && la.l2_psm)
 223                 return -EINVAL;
 224
 225         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 226                 return -EINVAL;
 227
 228         /* Check that the socket wasn't bound to something that
 229          * conflicts with the address given to connect(). If chan->src
 230          * is BDADDR_ANY it means bind() was never used, in which case
 231          * chan->src_type and la.l2_bdaddr_type do not need to match.
 232          */
 233         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 234             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 235                 /* Old user space versions will try to incorrectly bind
 236                  * the ATT socket using BDADDR_BREDR. We need to accept
 237                  * this and fix up the source address type only when
 238                  * both the source CID and destination CID indicate
 239                  * ATT. Anything else is an invalid combination.
 240                  */
 241                 if (chan->scid != L2CAP_CID_ATT ||
 242                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 243                         return -EINVAL;
 244
 245                 /* We don't have the hdev available here to make a
 246                  * better decision on random vs public, but since all
 247                  * user space versions that exhibit this issue anyway do
 248                  * not support random local addresses assuming public
 249                  * here is good enough.
 250                  */
 251                 chan->src_type = BDADDR_LE_PUBLIC;
 252         }
 253
 254         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 255                 return -EINVAL;
 256
 257         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 258                 /* We only allow ATT user space socket */
 259                 if (la.l2_cid &&
 260                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 261                         return -EINVAL;
 262         }
 263
 264         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 265          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 266          */
 267         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 268             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 269                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 270
 271         l2cap_sock_init_pid(sk);
 272
 273         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 274                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 275         if (err)
 276                 return err;
 277
 278         lock_sock(sk);
 279
 280         err = bt_sock_wait_state(sk, BT_CONNECTED,
 281                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 282
 283         release_sock(sk);
 284
 285         return err;
 286 }
 287
 288 static int l2cap_sock_listen(struct socket *sock, int backlog)
 289 {
 290         struct sock *sk = sock->sk;
 291         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 292         int err = 0;
 293
 294         BT_DBG("sk %p backlog %d", sk, backlog);
 295
 296         lock_sock(sk);
 297
 298         if (sk->sk_state != BT_BOUND) {
 299                 err = -EBADFD;
 300                 goto done;
 301         }
 302
 303         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 304                 err = -EINVAL;
 305                 goto done;
 306         }
 307
 308         switch (chan->mode) {
 309         case L2CAP_MODE_BASIC:
 310         case L2CAP_MODE_LE_FLOWCTL:
 311                 break;
 312         case L2CAP_MODE_EXT_FLOWCTL:
 313                 if (!enable_ecred) {
 314                         err = -EOPNOTSUPP;
 315                         goto done;
 316                 }
 317                 break;
 318         case L2CAP_MODE_ERTM:
 319         case L2CAP_MODE_STREAMING:
 320                 if (!disable_ertm)
 321                         break;
 322                 fallthrough;
 323         default:
 324                 err = -EOPNOTSUPP;
 325                 goto done;
 326         }
 327
 328         l2cap_sock_init_pid(sk);
 329
 330         sk->sk_max_ack_backlog = backlog;
 331         sk->sk_ack_backlog = 0;
 332
 333         /* Listening channels need to use nested locking in order not to
 334          * cause lockdep warnings when the created child channels end up
 335          * being locked in the same thread as the parent channel.
 336          */
 337         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 338
 339         chan->state = BT_LISTEN;
 340         sk->sk_state = BT_LISTEN;
 341
 342 done:
 343         release_sock(sk);
 344         return err;
 345 }
 346
 347 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 348                              int flags, bool kern)
 349 {
 350         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 351         struct sock *sk = sock->sk, *nsk;
 352         long timeo;
 353         int err = 0;
 354
 355         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 356
 357         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 358
 359         BT_DBG("sk %p timeo %ld", sk, timeo);
 360
 361         /* Wait for an incoming connection. (wake-one). */
 362         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 363         while (1) {
 364                 if (sk->sk_state != BT_LISTEN) {
 365                         err = -EBADFD;
 366                         break;
 367                 }
 368
 369                 nsk = bt_accept_dequeue(sk, newsock);
 370                 if (nsk)
 371                         break;
 372
 373                 if (!timeo) {
 374                         err = -EAGAIN;
 375                         break;
 376                 }
 377
 378                 if (signal_pending(current)) {
 379                         err = sock_intr_errno(timeo);
 380                         break;
 381                 }
 382
 383                 release_sock(sk);
 384
 385                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 386
 387                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 388         }
 389         remove_wait_queue(sk_sleep(sk), &wait);
 390
 391         if (err)
 392                 goto done;
 393
 394         newsock->state = SS_CONNECTED;
 395
 396         BT_DBG("new socket %p", nsk);
 397
 398 done:
 399         release_sock(sk);
 400         return err;
 401 }
 402
 403 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 404                               int peer)
 405 {
 406         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 407         struct sock *sk = sock->sk;
 408         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 409
 410         BT_DBG("sock %p, sk %p", sock, sk);
 411
 412         if (peer && sk->sk_state != BT_CONNECTED &&
 413             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 414             sk->sk_state != BT_CONFIG)
 415                 return -ENOTCONN;
 416
 417         memset(la, 0, sizeof(struct sockaddr_l2));
 418         addr->sa_family = AF_BLUETOOTH;
 419
 420         la->l2_psm = chan->psm;
 421
 422         if (peer) {
 423                 bacpy(&la->l2_bdaddr, &chan->dst);
 424                 la->l2_cid = cpu_to_le16(chan->dcid);
 425                 la->l2_bdaddr_type = chan->dst_type;
 426         } else {
 427                 bacpy(&la->l2_bdaddr, &chan->src);
 428                 la->l2_cid = cpu_to_le16(chan->scid);
 429                 la->l2_bdaddr_type = chan->src_type;
 430         }
 431
 432         return sizeof(struct sockaddr_l2);
 433 }
 434
 435 static int l2cap_get_mode(struct l2cap_chan *chan)
 436 {
 437         switch (chan->mode) {
 438         case L2CAP_MODE_BASIC:
 439                 return BT_MODE_BASIC;
 440         case L2CAP_MODE_ERTM:
 441                 return BT_MODE_ERTM;
 442         case L2CAP_MODE_STREAMING:
 443                 return BT_MODE_STREAMING;
 444         case L2CAP_MODE_LE_FLOWCTL:
 445                 return BT_MODE_LE_FLOWCTL;
 446         case L2CAP_MODE_EXT_FLOWCTL:
 447                 return BT_MODE_EXT_FLOWCTL;
 448         }
 449
 450         return -EINVAL;
 451 }
 452
 453 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 454                                      char __user *optval, int __user *optlen)
 455 {
 456         struct sock *sk = sock->sk;
 457         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 458         struct l2cap_options opts;
 459         struct l2cap_conninfo cinfo;
 460         int err = 0;
 461         size_t len;
 462         u32 opt;
 463
 464         BT_DBG("sk %p", sk);
 465
 466         if (get_user(len, optlen))
 467                 return -EFAULT;
 468
 469         lock_sock(sk);
 470
 471         switch (optname) {
 472         case L2CAP_OPTIONS:
 473                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 474                  * legacy ATT code depends on getsockopt for
 475                  * L2CAP_OPTIONS we need to let this pass.
 476                  */
 477                 if (bdaddr_type_is_le(chan->src_type) &&
 478                     chan->scid != L2CAP_CID_ATT) {
 479                         err = -EINVAL;
 480                         break;
 481                 }
 482
 483                 /* Only BR/EDR modes are supported here */
 484                 switch (chan->mode) {
 485                 case L2CAP_MODE_BASIC:
 486                 case L2CAP_MODE_ERTM:
 487                 case L2CAP_MODE_STREAMING:
 488                         break;
 489                 default:
 490                         err = -EINVAL;
 491                         break;
 492                 }
 493
 494                 if (err < 0)
 495                         break;
 496
 497                 memset(&opts, 0, sizeof(opts));
 498                 opts.imtu     = chan->imtu;
 499                 opts.omtu     = chan->omtu;
 500                 opts.flush_to = chan->flush_to;
 501                 opts.mode     = chan->mode;
 502                 opts.fcs      = chan->fcs;
 503                 opts.max_tx   = chan->max_tx;
 504                 opts.txwin_size = chan->tx_win;
 505
 506                 BT_DBG("mode 0x%2.2x", chan->mode);
 507
 508                 len = min(len, sizeof(opts));
 509                 if (copy_to_user(optval, (char *) &opts, len))
 510                         err = -EFAULT;
 511
 512                 break;
 513
 514         case L2CAP_LM:
 515                 switch (chan->sec_level) {
 516                 case BT_SECURITY_LOW:
 517                         opt = L2CAP_LM_AUTH;
 518                         break;
 519                 case BT_SECURITY_MEDIUM:
 520                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 521                         break;
 522                 case BT_SECURITY_HIGH:
 523                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 524                               L2CAP_LM_SECURE;
 525                         break;
 526                 case BT_SECURITY_FIPS:
 527                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 528                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 529                         break;
 530                 default:
 531                         opt = 0;
 532                         break;
 533                 }
 534
 535                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 536                         opt |= L2CAP_LM_MASTER;
 537
 538                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 539                         opt |= L2CAP_LM_RELIABLE;
 540
 541                 if (put_user(opt, (u32 __user *) optval))
 542                         err = -EFAULT;
 543
 544                 break;
 545
 546         case L2CAP_CONNINFO:
 547                 if (sk->sk_state != BT_CONNECTED &&
 548                     !(sk->sk_state == BT_CONNECT2 &&
 549                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 550                         err = -ENOTCONN;
 551                         break;
 552                 }
 553
 554                 memset(&cinfo, 0, sizeof(cinfo));
 555                 cinfo.hci_handle = chan->conn->hcon->handle;
 556                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 557
 558                 len = min(len, sizeof(cinfo));
 559                 if (copy_to_user(optval, (char *) &cinfo, len))
 560                         err = -EFAULT;
 561
 562                 break;
 563
 564         default:
 565                 err = -ENOPROTOOPT;
 566                 break;
 567         }
 568
 569         release_sock(sk);
 570         return err;
 571 }
 572
 573 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 574                                  char __user *optval, int __user *optlen)
 575 {
 576         struct sock *sk = sock->sk;
 577         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 578         struct bt_security sec;
 579         struct bt_power pwr;
 580         u32 phys;
 581         int len, mode, err = 0;
 582
 583         BT_DBG("sk %p", sk);
 584
 585         if (level == SOL_L2CAP)
 586                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 587
 588         if (level != SOL_BLUETOOTH)
 589                 return -ENOPROTOOPT;
 590
 591         if (get_user(len, optlen))
 592                 return -EFAULT;
 593
 594         lock_sock(sk);
 595
 596         switch (optname) {
 597         case BT_SECURITY:
 598                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 599                     chan->chan_type != L2CAP_CHAN_FIXED &&
 600                     chan->chan_type != L2CAP_CHAN_RAW) {
 601                         err = -EINVAL;
 602                         break;
 603                 }
 604
 605                 memset(&sec, 0, sizeof(sec));
 606                 if (chan->conn) {
 607                         sec.level = chan->conn->hcon->sec_level;
 608
 609                         if (sk->sk_state == BT_CONNECTED)
 610                                 sec.key_size = chan->conn->hcon->enc_key_size;
 611                 } else {
 612                         sec.level = chan->sec_level;
 613                 }
 614
 615                 len = min_t(unsigned int, len, sizeof(sec));
 616                 if (copy_to_user(optval, (char *) &sec, len))
 617                         err = -EFAULT;
 618
 619                 break;
 620
 621         case BT_DEFER_SETUP:
 622                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 623                         err = -EINVAL;
 624                         break;
 625                 }
 626
 627                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 628                              (u32 __user *) optval))
 629                         err = -EFAULT;
 630
 631                 break;
 632
 633         case BT_FLUSHABLE:
 634                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 635                              (u32 __user *) optval))
 636                         err = -EFAULT;
 637
 638                 break;
 639
 640         case BT_POWER:
 641                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 642                     && sk->sk_type != SOCK_RAW) {
 643                         err = -EINVAL;
 644                         break;
 645                 }
 646
 647                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 648
 649                 len = min_t(unsigned int, len, sizeof(pwr));
 650                 if (copy_to_user(optval, (char *) &pwr, len))
 651                         err = -EFAULT;
 652
 653                 break;
 654
 655         case BT_CHANNEL_POLICY:
 656                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 657                         err = -EFAULT;
 658                 break;
 659
 660         case BT_SNDMTU:
 661                 if (!bdaddr_type_is_le(chan->src_type)) {
 662                         err = -EINVAL;
 663                         break;
 664                 }
 665
 666                 if (sk->sk_state != BT_CONNECTED) {
 667                         err = -ENOTCONN;
 668                         break;
 669                 }
 670
 671                 if (put_user(chan->omtu, (u16 __user *) optval))
 672                         err = -EFAULT;
 673                 break;
 674
 675         case BT_RCVMTU:
 676                 if (!bdaddr_type_is_le(chan->src_type)) {
 677                         err = -EINVAL;
 678                         break;
 679                 }
 680
 681                 if (put_user(chan->imtu, (u16 __user *) optval))
 682                         err = -EFAULT;
 683                 break;
 684
 685         case BT_PHY:
 686                 if (sk->sk_state != BT_CONNECTED) {
 687                         err = -ENOTCONN;
 688                         break;
 689                 }
 690
 691                 phys = hci_conn_get_phy(chan->conn->hcon);
 692
 693                 if (put_user(phys, (u32 __user *) optval))
 694                         err = -EFAULT;
 695                 break;
 696
 697         case BT_MODE:
 698                 if (!enable_ecred) {
 699                         err = -ENOPROTOOPT;
 700                         break;
 701                 }
 702
 703                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 704                         err = -EINVAL;
 705                         break;
 706                 }
 707
 708                 mode = l2cap_get_mode(chan);
 709                 if (mode < 0) {
 710                         err = mode;
 711                         break;
 712                 }
 713
 714                 if (put_user(mode, (u8 __user *) optval))
 715                         err = -EFAULT;
 716                 break;
 717
 718         default:
 719                 err = -ENOPROTOOPT;
 720                 break;
 721         }
 722
 723         release_sock(sk);
 724         return err;
 725 }
 726
 727 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 728 {
 729         switch (chan->scid) {
 730         case L2CAP_CID_ATT:
 731                 if (mtu < L2CAP_LE_MIN_MTU)
 732                         return false;
 733                 break;
 734
 735         default:
 736                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 737                         return false;
 738         }
 739
 740         return true;
 741 }
 742
 743 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 744                                      sockptr_t optval, unsigned int optlen)
 745 {
 746         struct sock *sk = sock->sk;
 747         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 748         struct l2cap_options opts;
 749         int err = 0;
 750         u32 opt;
 751
 752         BT_DBG("sk %p", sk);
 753
 754         lock_sock(sk);
 755
 756         switch (optname) {
 757         case L2CAP_OPTIONS:
 758                 if (bdaddr_type_is_le(chan->src_type)) {
 759                         err = -EINVAL;
 760                         break;
 761                 }
 762
 763                 if (sk->sk_state == BT_CONNECTED) {
 764                         err = -EINVAL;
 765                         break;
 766                 }
 767
 768                 opts.imtu     = chan->imtu;
 769                 opts.omtu     = chan->omtu;
 770                 opts.flush_to = chan->flush_to;
 771                 opts.mode     = chan->mode;
 772                 opts.fcs      = chan->fcs;
 773                 opts.max_tx   = chan->max_tx;
 774                 opts.txwin_size = chan->tx_win;
 775
 776                 err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
 777                 if (err)
 778                         break;
 779
 780                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 781                         err = -EINVAL;
 782                         break;
 783                 }
 784
 785                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 786                         err = -EINVAL;
 787                         break;
 788                 }
 789
 790                 /* Only BR/EDR modes are supported here */
 791                 switch (opts.mode) {
 792                 case L2CAP_MODE_BASIC:
 793                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 794                         break;
 795                 case L2CAP_MODE_ERTM:
 796                 case L2CAP_MODE_STREAMING:
 797                         if (!disable_ertm)
 798                                 break;
 799                         fallthrough;
 800                 default:
 801                         err = -EINVAL;
 802                         break;
 803                 }
 804
 805                 if (err < 0)
 806                         break;
 807
 808                 chan->mode = opts.mode;
 809
 810                 BT_DBG("mode 0x%2.2x", chan->mode);
 811
 812                 chan->imtu = opts.imtu;
 813                 chan->omtu = opts.omtu;
 814                 chan->fcs  = opts.fcs;
 815                 chan->max_tx = opts.max_tx;
 816                 chan->tx_win = opts.txwin_size;
 817                 chan->flush_to = opts.flush_to;
 818                 break;
 819
 820         case L2CAP_LM:
 821                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 822                 if (err)
 823                         break;
 824
 825                 if (opt & L2CAP_LM_FIPS) {
 826                         err = -EINVAL;
 827                         break;
 828                 }
 829
 830                 if (opt & L2CAP_LM_AUTH)
 831                         chan->sec_level = BT_SECURITY_LOW;
 832                 if (opt & L2CAP_LM_ENCRYPT)
 833                         chan->sec_level = BT_SECURITY_MEDIUM;
 834                 if (opt & L2CAP_LM_SECURE)
 835                         chan->sec_level = BT_SECURITY_HIGH;
 836
 837                 if (opt & L2CAP_LM_MASTER)
 838                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 839                 else
 840                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 841
 842                 if (opt & L2CAP_LM_RELIABLE)
 843                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 844                 else
 845                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 846                 break;
 847
 848         default:
 849                 err = -ENOPROTOOPT;
 850                 break;
 851         }
 852
 853         release_sock(sk);
 854         return err;
 855 }
 856
 857 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 858 {
 859         switch (mode) {
 860         case BT_MODE_BASIC:
 861                 if (bdaddr_type_is_le(chan->src_type))
 862                         return -EINVAL;
 863                 mode = L2CAP_MODE_BASIC;
 864                 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 865                 break;
 866         case BT_MODE_ERTM:
 867                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 868                         return -EINVAL;
 869                 mode = L2CAP_MODE_ERTM;
 870                 break;
 871         case BT_MODE_STREAMING:
 872                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 873                         return -EINVAL;
 874                 mode = L2CAP_MODE_STREAMING;
 875                 break;
 876         case BT_MODE_LE_FLOWCTL:
 877                 if (!bdaddr_type_is_le(chan->src_type))
 878                         return -EINVAL;
 879                 mode = L2CAP_MODE_LE_FLOWCTL;
 880                 break;
 881         case BT_MODE_EXT_FLOWCTL:
 882                 /* TODO: Add support for ECRED PDUs to BR/EDR */
 883                 if (!bdaddr_type_is_le(chan->src_type))
 884                         return -EINVAL;
 885                 mode = L2CAP_MODE_EXT_FLOWCTL;
 886                 break;
 887         default:
 888                 return -EINVAL;
 889         }
 890
 891         chan->mode = mode;
 892
 893         return 0;
 894 }
 895
 896 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 897                                  sockptr_t optval, unsigned int optlen)
 898 {
 899         struct sock *sk = sock->sk;
 900         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 901         struct bt_security sec;
 902         struct bt_power pwr;
 903         struct l2cap_conn *conn;
 904         int err = 0;
 905         u32 opt;
 906         u16 mtu;
 907         u8 mode;
 908
 909         BT_DBG("sk %p", sk);
 910
 911         if (level == SOL_L2CAP)
 912                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 913
 914         if (level != SOL_BLUETOOTH)
 915                 return -ENOPROTOOPT;
 916
 917         lock_sock(sk);
 918
 919         switch (optname) {
 920         case BT_SECURITY:
 921                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 922                     chan->chan_type != L2CAP_CHAN_FIXED &&
 923                     chan->chan_type != L2CAP_CHAN_RAW) {
 924                         err = -EINVAL;
 925                         break;
 926                 }
 927
 928                 sec.level = BT_SECURITY_LOW;
 929
 930                 err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
 931                 if (err)
 932                         break;
 933
 934                 if (sec.level < BT_SECURITY_LOW ||
 935                     sec.level > BT_SECURITY_FIPS) {
 936                         err = -EINVAL;
 937                         break;
 938                 }
 939
 940                 chan->sec_level = sec.level;
 941
 942                 if (!chan->conn)
 943                         break;
 944
 945                 conn = chan->conn;
 946
 947                 /* change security for LE channels */
 948                 if (chan->scid == L2CAP_CID_ATT) {
 949                         if (smp_conn_security(conn->hcon, sec.level)) {
 950                                 err = -EINVAL;
 951                                 break;
 952                         }
 953
 954                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 955                         sk->sk_state = BT_CONFIG;
 956                         chan->state = BT_CONFIG;
 957
 958                 /* or for ACL link */
 959                 } else if ((sk->sk_state == BT_CONNECT2 &&
 960                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 961                            sk->sk_state == BT_CONNECTED) {
 962                         if (!l2cap_chan_check_security(chan, true))
 963                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 964                         else
 965                                 sk->sk_state_change(sk);
 966                 } else {
 967                         err = -EINVAL;
 968                 }
 969                 break;
 970
 971         case BT_DEFER_SETUP:
 972                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 973                         err = -EINVAL;
 974                         break;
 975                 }
 976
 977                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 978                 if (err)
 979                         break;
 980
 981                 if (opt) {
 982                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 983                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 984                 } else {
 985                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 986                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 987                 }
 988                 break;
 989
 990         case BT_FLUSHABLE:
 991                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
 992                 if (err)
 993                         break;
 994
 995                 if (opt > BT_FLUSHABLE_ON) {
 996                         err = -EINVAL;
 997                         break;
 998                 }
 999
1000                 if (opt == BT_FLUSHABLE_OFF) {
1001                         conn = chan->conn;
1002                         /* proceed further only when we have l2cap_conn and
1003                            No Flush support in the LM */
1004                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
1005                                 err = -EINVAL;
1006                                 break;
1007                         }
1008                 }
1009
1010                 if (opt)
1011                         set_bit(FLAG_FLUSHABLE, &chan->flags);
1012                 else
1013                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
1014                 break;
1015
1016         case BT_POWER:
1017                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1018                     chan->chan_type != L2CAP_CHAN_RAW) {
1019                         err = -EINVAL;
1020                         break;
1021                 }
1022
1023                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1024
1025                 err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1026                 if (err)
1027                         break;
1028
1029                 if (pwr.force_active)
1030                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1031                 else
1032                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1033                 break;
1034
1035         case BT_CHANNEL_POLICY:
1036                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
1037                 if (err)
1038                         break;
1039
1040                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
1041                         err = -EINVAL;
1042                         break;
1043                 }
1044
1045                 if (chan->mode != L2CAP_MODE_ERTM &&
1046                     chan->mode != L2CAP_MODE_STREAMING) {
1047                         err = -EOPNOTSUPP;
1048                         break;
1049                 }
1050
1051                 chan->chan_policy = (u8) opt;
1052
1053                 if (sk->sk_state == BT_CONNECTED &&
1054                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
1055                         l2cap_move_start(chan);
1056
1057                 break;
1058
1059         case BT_SNDMTU:
1060                 if (!bdaddr_type_is_le(chan->src_type)) {
1061                         err = -EINVAL;
1062                         break;
1063                 }
1064
1065                 /* Setting is not supported as it's the remote side that
1066                  * decides this.
1067                  */
1068                 err = -EPERM;
1069                 break;
1070
1071         case BT_RCVMTU:
1072                 if (!bdaddr_type_is_le(chan->src_type)) {
1073                         err = -EINVAL;
1074                         break;
1075                 }
1076
1077                 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1078                     sk->sk_state == BT_CONNECTED) {
1079                         err = -EISCONN;
1080                         break;
1081                 }
1082
1083                 err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1084                 if (err)
1085                         break;
1086
1087                 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1088                     sk->sk_state == BT_CONNECTED)
1089                         err = l2cap_chan_reconfigure(chan, mtu);
1090                 else
1091                         chan->imtu = mtu;
1092
1093                 break;
1094
1095         case BT_MODE:
1096                 if (!enable_ecred) {
1097                         err = -ENOPROTOOPT;
1098                         break;
1099                 }
1100
1101                 BT_DBG("sk->sk_state %u", sk->sk_state);
1102
1103                 if (sk->sk_state != BT_BOUND) {
1104                         err = -EINVAL;
1105                         break;
1106                 }
1107
1108                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1109                         err = -EINVAL;
1110                         break;
1111                 }
1112
1113                 err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
1114                 if (err)
1115                         break;
1116
1117                 BT_DBG("mode %u", mode);
1118
1119                 err = l2cap_set_mode(chan, mode);
1120                 if (err)
1121                         break;
1122
1123                 BT_DBG("mode 0x%2.2x", chan->mode);
1124
1125                 break;
1126
1127         default:
1128                 err = -ENOPROTOOPT;
1129                 break;
1130         }
1131
1132         release_sock(sk);
1133         return err;
1134 }
1135
1136 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1137                               size_t len)
1138 {
1139         struct sock *sk = sock->sk;
1140         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1141         int err;
1142
1143         BT_DBG("sock %p, sk %p", sock, sk);
1144
1145         err = sock_error(sk);
1146         if (err)
1147                 return err;
1148
1149         if (msg->msg_flags & MSG_OOB)
1150                 return -EOPNOTSUPP;
1151
1152         if (sk->sk_state != BT_CONNECTED)
1153                 return -ENOTCONN;
1154
1155         lock_sock(sk);
1156         err = bt_sock_wait_ready(sk, msg->msg_flags);
1157         release_sock(sk);
1158         if (err)
1159                 return err;
1160
1161         l2cap_chan_lock(chan);
1162         err = l2cap_chan_send(chan, msg, len);
1163         l2cap_chan_unlock(chan);
1164
1165         return err;
1166 }
1167
1168 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1169                               size_t len, int flags)
1170 {
1171         struct sock *sk = sock->sk;
1172         struct l2cap_pinfo *pi = l2cap_pi(sk);
1173         int err;
1174
1175         lock_sock(sk);
1176
1177         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1178                                                     &bt_sk(sk)->flags)) {
1179                 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1180                         sk->sk_state = BT_CONNECTED;
1181                         pi->chan->state = BT_CONNECTED;
1182                         __l2cap_ecred_conn_rsp_defer(pi->chan);
1183                 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1184                         sk->sk_state = BT_CONNECTED;
1185                         pi->chan->state = BT_CONNECTED;
1186                         __l2cap_le_connect_rsp_defer(pi->chan);
1187                 } else {
1188                         sk->sk_state = BT_CONFIG;
1189                         pi->chan->state = BT_CONFIG;
1190                         __l2cap_connect_rsp_defer(pi->chan);
1191                 }
1192
1193                 err = 0;
1194                 goto done;
1195         }
1196
1197         release_sock(sk);
1198
1199         if (sock->type == SOCK_STREAM)
1200                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1201         else
1202                 err = bt_sock_recvmsg(sock, msg, len, flags);
1203
1204         if (pi->chan->mode != L2CAP_MODE_ERTM)
1205                 return err;
1206
1207         /* Attempt to put pending rx data in the socket buffer */
1208
1209         lock_sock(sk);
1210
1211         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1212                 goto done;
1213
1214         if (pi->rx_busy_skb) {
1215                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1216                         pi->rx_busy_skb = NULL;
1217                 else
1218                         goto done;
1219         }
1220
1221         /* Restore data flow when half of the receive buffer is
1222          * available.  This avoids resending large numbers of
1223          * frames.
1224          */
1225         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1226                 l2cap_chan_busy(pi->chan, 0);
1227
1228 done:
1229         release_sock(sk);
1230         return err;
1231 }
1232
1233 /* Kill socket (only if zapped and orphan)
1234  * Must be called on unlocked socket, with l2cap channel lock.
1235  */
1236 static void l2cap_sock_kill(struct sock *sk)
1237 {
1238         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1239                 return;
1240
1241         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1242
1243         /* Kill poor orphan */
1244
1245         l2cap_chan_put(l2cap_pi(sk)->chan);
1246         sock_set_flag(sk, SOCK_DEAD);
1247         sock_put(sk);
1248 }
1249
1250 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1251 {
1252         DECLARE_WAITQUEUE(wait, current);
1253         int err = 0;
1254         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1255         /* Timeout to prevent infinite loop */
1256         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1257
1258         add_wait_queue(sk_sleep(sk), &wait);
1259         set_current_state(TASK_INTERRUPTIBLE);
1260         do {
1261                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1262                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1263                        jiffies_to_msecs(timeout - jiffies));
1264
1265                 if (!timeo)
1266                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1267
1268                 if (signal_pending(current)) {
1269                         err = sock_intr_errno(timeo);
1270                         break;
1271                 }
1272
1273                 release_sock(sk);
1274                 timeo = schedule_timeout(timeo);
1275                 lock_sock(sk);
1276                 set_current_state(TASK_INTERRUPTIBLE);
1277
1278                 err = sock_error(sk);
1279                 if (err)
1280                         break;
1281
1282                 if (time_after(jiffies, timeout)) {
1283                         err = -ENOLINK;
1284                         break;
1285                 }
1286
1287         } while (chan->unacked_frames > 0 &&
1288                  chan->state == BT_CONNECTED);
1289
1290         set_current_state(TASK_RUNNING);
1291         remove_wait_queue(sk_sleep(sk), &wait);
1292         return err;
1293 }
1294
1295 static int l2cap_sock_shutdown(struct socket *sock, int how)
1296 {
1297         struct sock *sk = sock->sk;
1298         struct l2cap_chan *chan;
1299         struct l2cap_conn *conn;
1300         int err = 0;
1301
1302         BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1303
1304         /* 'how' parameter is mapped to sk_shutdown as follows:
1305          * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1306          * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1307          * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1308          */
1309         how++;
1310
1311         if (!sk)
1312                 return 0;
1313
1314         lock_sock(sk);
1315
1316         if ((sk->sk_shutdown & how) == how)
1317                 goto shutdown_already;
1318
1319         BT_DBG("Handling sock shutdown");
1320
1321         /* prevent sk structure from being freed whilst unlocked */
1322         sock_hold(sk);
1323
1324         chan = l2cap_pi(sk)->chan;
1325         /* prevent chan structure from being freed whilst unlocked */
1326         l2cap_chan_hold(chan);
1327
1328         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1329
1330         if (chan->mode == L2CAP_MODE_ERTM &&
1331             chan->unacked_frames > 0 &&
1332             chan->state == BT_CONNECTED) {
1333                 err = __l2cap_wait_ack(sk, chan);
1334
1335                 /* After waiting for ACKs, check whether shutdown
1336                  * has already been actioned to close the L2CAP
1337                  * link such as by l2cap_disconnection_req().
1338                  */
1339                 if ((sk->sk_shutdown & how) == how)
1340                         goto shutdown_matched;
1341         }
1342
1343         /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1344          * is already set
1345          */
1346         if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1347                 sk->sk_shutdown |= RCV_SHUTDOWN;
1348                 if ((sk->sk_shutdown & how) == how)
1349                         goto shutdown_matched;
1350         }
1351
1352         sk->sk_shutdown |= SEND_SHUTDOWN;
1353         release_sock(sk);
1354
1355         l2cap_chan_lock(chan);
1356         conn = chan->conn;
1357         if (conn)
1358                 /* prevent conn structure from being freed */
1359                 l2cap_conn_get(conn);
1360         l2cap_chan_unlock(chan);
1361
1362         if (conn)
1363                 /* mutex lock must be taken before l2cap_chan_lock() */
1364                 mutex_lock(&conn->chan_lock);
1365
1366         l2cap_chan_lock(chan);
1367         l2cap_chan_close(chan, 0);
1368         l2cap_chan_unlock(chan);
1369
1370         if (conn) {
1371                 mutex_unlock(&conn->chan_lock);
1372                 l2cap_conn_put(conn);
1373         }
1374
1375         lock_sock(sk);
1376
1377         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1378             !(current->flags & PF_EXITING))
1379                 err = bt_sock_wait_state(sk, BT_CLOSED,
1380                                          sk->sk_lingertime);
1381
1382 shutdown_matched:
1383         l2cap_chan_put(chan);
1384         sock_put(sk);
1385
1386 shutdown_already:
1387         if (!err && sk->sk_err)
1388                 err = -sk->sk_err;
1389
1390         release_sock(sk);
1391
1392         BT_DBG("Sock shutdown complete err: %d", err);
1393
1394         return err;
1395 }
1396
1397 static int l2cap_sock_release(struct socket *sock)
1398 {
1399         struct sock *sk = sock->sk;
1400         int err;
1401         struct l2cap_chan *chan;
1402
1403         BT_DBG("sock %p, sk %p", sock, sk);
1404
1405         if (!sk)
1406                 return 0;
1407
1408         l2cap_sock_cleanup_listen(sk);
1409         bt_sock_unlink(&l2cap_sk_list, sk);
1410
1411         err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1412         chan = l2cap_pi(sk)->chan;
1413
1414         l2cap_chan_hold(chan);
1415         l2cap_chan_lock(chan);
1416
1417         sock_orphan(sk);
1418         l2cap_sock_kill(sk);
1419
1420         l2cap_chan_unlock(chan);
1421         l2cap_chan_put(chan);
1422
1423         return err;
1424 }
1425
1426 static void l2cap_sock_cleanup_listen(struct sock *parent)
1427 {
1428         struct sock *sk;
1429
1430         BT_DBG("parent %p state %s", parent,
1431                state_to_string(parent->sk_state));
1432
1433         /* Close not yet accepted channels */
1434         while ((sk = bt_accept_dequeue(parent, NULL))) {
1435                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1436
1437                 BT_DBG("child chan %p state %s", chan,
1438                        state_to_string(chan->state));
1439
1440                 l2cap_chan_hold(chan);
1441                 l2cap_chan_lock(chan);
1442
1443                 __clear_chan_timer(chan);
1444                 l2cap_chan_close(chan, ECONNRESET);
1445                 l2cap_sock_kill(sk);
1446
1447                 l2cap_chan_unlock(chan);
1448                 l2cap_chan_put(chan);
1449         }
1450 }
1451
1452 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1453 {
1454         struct sock *sk, *parent = chan->data;
1455
1456         lock_sock(parent);
1457
1458         /* Check for backlog size */
1459         if (sk_acceptq_is_full(parent)) {
1460                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1461                 release_sock(parent);
1462                 return NULL;
1463         }
1464
1465         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1466                               GFP_ATOMIC, 0);
1467         if (!sk) {
1468                 release_sock(parent);
1469                 return NULL;
1470         }
1471
1472         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1473
1474         l2cap_sock_init(sk, parent);
1475
1476         bt_accept_enqueue(parent, sk, false);
1477
1478         release_sock(parent);
1479
1480         return l2cap_pi(sk)->chan;
1481 }
1482
1483 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1484 {
1485         struct sock *sk = chan->data;
1486         int err;
1487
1488         lock_sock(sk);
1489
1490         if (l2cap_pi(sk)->rx_busy_skb) {
1491                 err = -ENOMEM;
1492                 goto done;
1493         }
1494
1495         if (chan->mode != L2CAP_MODE_ERTM &&
1496             chan->mode != L2CAP_MODE_STREAMING) {
1497                 /* Even if no filter is attached, we could potentially
1498                  * get errors from security modules, etc.
1499                  */
1500                 err = sk_filter(sk, skb);
1501                 if (err)
1502                         goto done;
1503         }
1504
1505         err = __sock_queue_rcv_skb(sk, skb);
1506
1507         /* For ERTM, handle one skb that doesn't fit into the recv
1508          * buffer.  This is important to do because the data frames
1509          * have already been acked, so the skb cannot be discarded.
1510          *
1511          * Notify the l2cap core that the buffer is full, so the
1512          * LOCAL_BUSY state is entered and no more frames are
1513          * acked and reassembled until there is buffer space
1514          * available.
1515          */
1516         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1517                 l2cap_pi(sk)->rx_busy_skb = skb;
1518                 l2cap_chan_busy(chan, 1);
1519                 err = 0;
1520         }
1521
1522 done:
1523         release_sock(sk);
1524
1525         return err;
1526 }
1527
1528 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1529 {
1530         struct sock *sk = chan->data;
1531
1532         if (!sk)
1533                 return;
1534
1535         l2cap_sock_kill(sk);
1536 }
1537
1538 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1539 {
1540         struct sock *sk = chan->data;
1541         struct sock *parent;
1542
1543         if (!sk)
1544                 return;
1545
1546         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1547
1548         /* This callback can be called both for server (BT_LISTEN)
1549          * sockets as well as "normal" ones. To avoid lockdep warnings
1550          * with child socket locking (through l2cap_sock_cleanup_listen)
1551          * we need separation into separate nesting levels. The simplest
1552          * way to accomplish this is to inherit the nesting level used
1553          * for the channel.
1554          */
1555         lock_sock_nested(sk, atomic_read(&chan->nesting));
1556
1557         parent = bt_sk(sk)->parent;
1558
1559         switch (chan->state) {
1560         case BT_OPEN:
1561         case BT_BOUND:
1562         case BT_CLOSED:
1563                 break;
1564         case BT_LISTEN:
1565                 l2cap_sock_cleanup_listen(sk);
1566                 sk->sk_state = BT_CLOSED;
1567                 chan->state = BT_CLOSED;
1568
1569                 break;
1570         default:
1571                 sk->sk_state = BT_CLOSED;
1572                 chan->state = BT_CLOSED;
1573
1574                 sk->sk_err = err;
1575
1576                 if (parent) {
1577                         bt_accept_unlink(sk);
1578                         parent->sk_data_ready(parent);
1579                 } else {
1580                         sk->sk_state_change(sk);
1581                 }
1582
1583                 break;
1584         }
1585         release_sock(sk);
1586
1587         /* Only zap after cleanup to avoid use after free race */
1588         sock_set_flag(sk, SOCK_ZAPPED);
1589
1590 }
1591
1592 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1593                                        int err)
1594 {
1595         struct sock *sk = chan->data;
1596
1597         sk->sk_state = state;
1598
1599         if (err)
1600                 sk->sk_err = err;
1601 }
1602
1603 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1604                                                unsigned long hdr_len,
1605                                                unsigned long len, int nb)
1606 {
1607         struct sock *sk = chan->data;
1608         struct sk_buff *skb;
1609         int err;
1610
1611         l2cap_chan_unlock(chan);
1612         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1613         l2cap_chan_lock(chan);
1614
1615         if (!skb)
1616                 return ERR_PTR(err);
1617
1618         /* Channel lock is released before requesting new skb and then
1619          * reacquired thus we need to recheck channel state.
1620          */
1621         if (chan->state != BT_CONNECTED) {
1622                 kfree_skb(skb);
1623                 return ERR_PTR(-ENOTCONN);
1624         }
1625
1626         skb->priority = sk->sk_priority;
1627
1628         bt_cb(skb)->l2cap.chan = chan;
1629
1630         return skb;
1631 }
1632
1633 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1634 {
1635         struct sock *sk = chan->data;
1636         struct sock *parent;
1637
1638         lock_sock(sk);
1639
1640         parent = bt_sk(sk)->parent;
1641
1642         BT_DBG("sk %p, parent %p", sk, parent);
1643
1644         sk->sk_state = BT_CONNECTED;
1645         sk->sk_state_change(sk);
1646
1647         if (parent)
1648                 parent->sk_data_ready(parent);
1649
1650         release_sock(sk);
1651 }
1652
1653 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1654 {
1655         struct sock *parent, *sk = chan->data;
1656
1657         lock_sock(sk);
1658
1659         parent = bt_sk(sk)->parent;
1660         if (parent)
1661                 parent->sk_data_ready(parent);
1662
1663         release_sock(sk);
1664 }
1665
1666 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1667 {
1668         struct sock *sk = chan->data;
1669
1670         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1671                 sk->sk_state = BT_CONNECTED;
1672                 chan->state = BT_CONNECTED;
1673         }
1674
1675         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1676         sk->sk_state_change(sk);
1677 }
1678
1679 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1680 {
1681         struct sock *sk = chan->data;
1682
1683         lock_sock(sk);
1684         sk->sk_shutdown = SHUTDOWN_MASK;
1685         release_sock(sk);
1686 }
1687
1688 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1689 {
1690         struct sock *sk = chan->data;
1691
1692         return sk->sk_sndtimeo;
1693 }
1694
1695 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1696 {
1697         struct sock *sk = chan->data;
1698
1699         return sk->sk_peer_pid;
1700 }
1701
1702 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1703 {
1704         struct sock *sk = chan->data;
1705
1706         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1707         sk->sk_state_change(sk);
1708 }
1709
1710 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1711 {
1712         struct sock *sk = chan->data;
1713
1714         switch (chan->mode) {
1715         case L2CAP_MODE_ERTM:
1716         case L2CAP_MODE_STREAMING:
1717                 return sk_filter(sk, skb);
1718         }
1719
1720         return 0;
1721 }
1722
1723 static const struct l2cap_ops l2cap_chan_ops = {
1724         .name                   = "L2CAP Socket Interface",
1725         .new_connection         = l2cap_sock_new_connection_cb,
1726         .recv                   = l2cap_sock_recv_cb,
1727         .close                  = l2cap_sock_close_cb,
1728         .teardown               = l2cap_sock_teardown_cb,
1729         .state_change           = l2cap_sock_state_change_cb,
1730         .ready                  = l2cap_sock_ready_cb,
1731         .defer                  = l2cap_sock_defer_cb,
1732         .resume                 = l2cap_sock_resume_cb,
1733         .suspend                = l2cap_sock_suspend_cb,
1734         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1735         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1736         .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
1737         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1738         .filter                 = l2cap_sock_filter,
1739 };
1740
1741 static void l2cap_sock_destruct(struct sock *sk)
1742 {
1743         BT_DBG("sk %p", sk);
1744
1745         if (l2cap_pi(sk)->chan) {
1746                 l2cap_pi(sk)->chan->data = NULL;
1747                 l2cap_chan_put(l2cap_pi(sk)->chan);
1748         }
1749
1750         if (l2cap_pi(sk)->rx_busy_skb) {
1751                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1752                 l2cap_pi(sk)->rx_busy_skb = NULL;
1753         }
1754
1755         skb_queue_purge(&sk->sk_receive_queue);
1756         skb_queue_purge(&sk->sk_write_queue);
1757 }
1758
1759 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1760                                int *msg_namelen)
1761 {
1762         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1763
1764         memset(la, 0, sizeof(struct sockaddr_l2));
1765         la->l2_family = AF_BLUETOOTH;
1766         la->l2_psm = bt_cb(skb)->l2cap.psm;
1767         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1768
1769         *msg_namelen = sizeof(struct sockaddr_l2);
1770 }
1771
1772 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1773 {
1774         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1775
1776         BT_DBG("sk %p", sk);
1777
1778         if (parent) {
1779                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1780
1781                 sk->sk_type = parent->sk_type;
1782                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1783
1784                 chan->chan_type = pchan->chan_type;
1785                 chan->imtu = pchan->imtu;
1786                 chan->omtu = pchan->omtu;
1787                 chan->conf_state = pchan->conf_state;
1788                 chan->mode = pchan->mode;
1789                 chan->fcs  = pchan->fcs;
1790                 chan->max_tx = pchan->max_tx;
1791                 chan->tx_win = pchan->tx_win;
1792                 chan->tx_win_max = pchan->tx_win_max;
1793                 chan->sec_level = pchan->sec_level;
1794                 chan->flags = pchan->flags;
1795                 chan->tx_credits = pchan->tx_credits;
1796                 chan->rx_credits = pchan->rx_credits;
1797
1798                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1799                         chan->scid = pchan->scid;
1800                         chan->dcid = pchan->scid;
1801                 }
1802
1803                 security_sk_clone(parent, sk);
1804         } else {
1805                 switch (sk->sk_type) {
1806                 case SOCK_RAW:
1807                         chan->chan_type = L2CAP_CHAN_RAW;
1808                         break;
1809                 case SOCK_DGRAM:
1810                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1811                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1812                         break;
1813                 case SOCK_SEQPACKET:
1814                 case SOCK_STREAM:
1815                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1816                         break;
1817                 }
1818
1819                 chan->imtu = L2CAP_DEFAULT_MTU;
1820                 chan->omtu = 0;
1821                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1822                         chan->mode = L2CAP_MODE_ERTM;
1823                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1824                 } else {
1825                         chan->mode = L2CAP_MODE_BASIC;
1826                 }
1827
1828                 l2cap_chan_set_defaults(chan);
1829         }
1830
1831         /* Default config options */
1832         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1833
1834         chan->data = sk;
1835         chan->ops = &l2cap_chan_ops;
1836 }
1837
1838 static struct proto l2cap_proto = {
1839         .name           = "L2CAP",
1840         .owner          = THIS_MODULE,
1841         .obj_size       = sizeof(struct l2cap_pinfo)
1842 };
1843
1844 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1845                                      int proto, gfp_t prio, int kern)
1846 {
1847         struct sock *sk;
1848         struct l2cap_chan *chan;
1849
1850         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1851         if (!sk)
1852                 return NULL;
1853
1854         sock_init_data(sock, sk);
1855         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1856
1857         sk->sk_destruct = l2cap_sock_destruct;
1858         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1859
1860         sock_reset_flag(sk, SOCK_ZAPPED);
1861
1862         sk->sk_protocol = proto;
1863         sk->sk_state = BT_OPEN;
1864
1865         chan = l2cap_chan_create();
1866         if (!chan) {
1867                 sk_free(sk);
1868                 return NULL;
1869         }
1870
1871         l2cap_chan_hold(chan);
1872
1873         l2cap_pi(sk)->chan = chan;
1874
1875         return sk;
1876 }
1877
1878 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1879                              int kern)
1880 {
1881         struct sock *sk;
1882
1883         BT_DBG("sock %p", sock);
1884
1885         sock->state = SS_UNCONNECTED;
1886
1887         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1888             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1889                 return -ESOCKTNOSUPPORT;
1890
1891         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1892                 return -EPERM;
1893
1894         sock->ops = &l2cap_sock_ops;
1895
1896         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1897         if (!sk)
1898                 return -ENOMEM;
1899
1900         l2cap_sock_init(sk, NULL);
1901         bt_sock_link(&l2cap_sk_list, sk);
1902         return 0;
1903 }
1904
1905 static const struct proto_ops l2cap_sock_ops = {
1906         .family         = PF_BLUETOOTH,
1907         .owner          = THIS_MODULE,
1908         .release        = l2cap_sock_release,
1909         .bind           = l2cap_sock_bind,
1910         .connect        = l2cap_sock_connect,
1911         .listen         = l2cap_sock_listen,
1912         .accept         = l2cap_sock_accept,
1913         .getname        = l2cap_sock_getname,
1914         .sendmsg        = l2cap_sock_sendmsg,
1915         .recvmsg        = l2cap_sock_recvmsg,
1916         .poll           = bt_sock_poll,
1917         .ioctl          = bt_sock_ioctl,
1918         .gettstamp      = sock_gettstamp,
1919         .mmap           = sock_no_mmap,
1920         .socketpair     = sock_no_socketpair,
1921         .shutdown       = l2cap_sock_shutdown,
1922         .setsockopt     = l2cap_sock_setsockopt,
1923         .getsockopt     = l2cap_sock_getsockopt
1924 };
1925
1926 static const struct net_proto_family l2cap_sock_family_ops = {
1927         .family = PF_BLUETOOTH,
1928         .owner  = THIS_MODULE,
1929         .create = l2cap_sock_create,
1930 };
1931
1932 int __init l2cap_init_sockets(void)
1933 {
1934         int err;
1935
1936         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1937
1938         err = proto_register(&l2cap_proto, 0);
1939         if (err < 0)
1940                 return err;
1941
1942         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1943         if (err < 0) {
1944                 BT_ERR("L2CAP socket registration failed");
1945                 goto error;
1946         }
1947
1948         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1949                              NULL);
1950         if (err < 0) {
1951                 BT_ERR("Failed to create L2CAP proc file");
1952                 bt_sock_unregister(BTPROTO_L2CAP);
1953                 goto error;
1954         }
1955
1956         BT_INFO("L2CAP socket layer initialized");
1957
1958         return 0;
1959
1960 error:
1961         proto_unregister(&l2cap_proto);
1962         return err;
1963 }
1964
1965 void l2cap_cleanup_sockets(void)
1966 {
1967         bt_procfs_cleanup(&init_net, "l2cap");
1968         bt_sock_unregister(BTPROTO_L2CAP);
1969         proto_unregister(&l2cap_proto);
1970 }